Read the docs
TI-2026-84804 Aliases CVE-2026-119084

Unsafe class loading in Amazon Redshift JDBC Driver allows code execution

Priority MEDIUM 42CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Amazon Redshift JDBC Driver before 2.3.0 is affected. Unsafe reflection in connection parameter and credentials profile handling lets an actor who can influence the JDBC connection URL or the AWS credentials profile run arbitrary code in the application context, provided a suitable class is on the application classpath. The flaw is CWE-470, use of externally controlled input to select classes or code.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix Fixed amazon-redshift-jdbc-driver (AWS): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSamazon-redshift-jdbc-driverbefore 2.3.02.3.0Patch availableCNA
  • amazon-redshift-jdbc-driver VendorAWS Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

Remediation

Upgrade amazon-redshift-jdbc-driver to version 2.3.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA amazon-redshift-jdbc-driver (AWS) Fixed in 2.3.0

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-119084
  2. 2026-11-06 CISA SSVC decision points changed

References

Patch 1

Advisory 2

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences