AWS Cloud Development Kit: SQL injection in @aws-cdk/aws-redshift-alpha (CVE-2026-115418)
An SQL injection vulnerability in the @aws-cdk/aws-redshift-alpha module allows attackers to execute arbitrary SQL commands with superuser privileges on Amazon Redshift clusters by manipulating construct property values.
CVE search metadata
CVE search record: CVE-2026-115418. Severity: high. CVSS: 7.3. KEV: no. Product: AWS Cloud Development Kit (@aws-cdk/aws-redshift-alpha < 2.274.0-alpha.0). Brief: AWS Cloud Development Kit: SQL injection in @aws-cdk/aws-redshift-alpha (CVE-2026-115418). Brief link: https://feed.craftedsignal.io/briefs/2026-10-aws-cdk-sqli/
Triage facts
Revision 1- Applicability
- AWS Cloud Development Kit (@aws-cdk/aws-redshift-alpha < 2.274.0-alpha.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 19:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The @aws-cdk/aws-redshift-alpha module within the AWS Cloud Development Kit (CDK) contains an SQL injection vulnerability in its database-query custom resource handlers. This flaw allows an attacker who can influence construct property values (specifically user names, comments, or passwords) to execute arbitrary SQL statements with Amazon Redshift superuser privileges. This could lead to unauthorized privilege escalation and modification of cluster access controls.
Impact
Successful exploitation grants an attacker Amazon Redshift superuser privileges, allowing them to grant access to cluster users or modify database permissions, potentially compromising the integrity and confidentiality of data stored within the cluster.
Recommendation
- Upgrade the @aws-cdk/aws-redshift-alpha module to version 2.274.0-alpha.0 or later immediately.
- Review existing table grants and permissions assigned to the PUBLIC role in impacted Amazon Redshift clusters to identify unauthorized modifications.
Immediate actions
Upgrade @aws-cdk/aws-redshift-alpha to version 2.274.0-alpha.0 or later.
Threat Hunt
Review CloudTrail logs or AWS Config logs for unexpected Redshift superuser activity or unauthorized GRANT statements.
Data: AWS CloudTrail, Amazon Redshift Audit Logs
Mitigations
Audit current database grants for the PUBLIC role to detect unauthorized access.
CVE-2026-115418