Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver ...

Aws.Amazon • November 3, 2026

CVE-2026-119084 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

Bulletin ID: 2026-168-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/03/2026 13:00 PM PST

Amazon Redshift JDBC Driver is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs). We identified CVE-2026-119084, an issue in Amazon Redshift JDBC Driver versions prior to 2.3.0. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters or AWS credentials profile fields. An actor who can influence the connection URL or credentials profile could potentially execute code in the application context.

Impacted versions: Amazon Redshift JDBC Driver < 2.3.0

This issue has been addressed in Amazon Redshift JDBC Driver version 2.3.0 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The latest driver is available from the Amazon Redshift documentation and Maven Central .

If you cannot upgrade immediately, review how your application builds JDBC connection URLs and AWS credentials profiles. Do not build them from untrusted input, or validate any externally supplied values against an allowlist of expected parameters and values.

We would like to thank 4ra1n, pyn3rd and unam4 for collaborating on this issue through the coordinated vulnerability disclosure process.

Please email [email protected] with any security questions or concerns.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerability in Amazon Redshift JDBC Driver A vulnerability, CVE-2026-119084, was disclosed on November 3, 2026, affecting Amazon Redshift JDBC Driver versions prior to 2.3.0. The flaw allows an attacker to execute arbitrary code by manipulating JDBC connection URL parameters or AWS credentials profile fields. This vulnerability could be exploited if an actor can influence these parameters, leading to potential code execution in the application's context. Amazon has released version 2.3.0 to address this issue and recommends immediate upgrades. Users unable to upgrade should ensure that their applications do not construct JDBC connection URLs from untrusted input. The vulnerability has a CVSS score of 8.1, indicating a high severity level. Security researchers involved in the disclosure process include 4ra1n, pyn3rd, and unam4. 2 sources 72

Extracted Entities

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver ...

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Email Addresses (1)

Platforms (1)