Cpe:2.3:a:amazon:redshift_jdbc_driver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aamazonredshift_jdbc_driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 00:46:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAmazon Redshift JDBC Driver: Remote code execution via unsafe reflection (CVE-2026-119084)https://feed.craftedsignal.io/briefs/2026-11-redshift-jdbc-rce/Wed, 04 Nov 2026 00:46:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-redshift-jdbc-rce/The Amazon Redshift JDBC Driver before version 2.3.0 is vulnerable to remote code execution due to unsafe class loading and reflection triggered by malicious JDBC connection strings or credential profiles.Amazon Redshift JDBC Driver versions prior to 2.3.0 are susceptible to an RCE vulnerability (CVE-2026-119084) arising from unsafe reflection in connection parameters and AWS credentials profile handling. An unauthenticated attacker capable of influencing the JDBC connection URL or the AWS credentials configuration can execute arbitrary code within the application process, provided a gadget class is present on the application classpath.

Impact

Successful exploitation allows for remote code execution in the context of the application using the affected driver, potentially leading to full system compromise or lateral movement within the environment hosting the application.

Recommendation

  • Upgrade the Amazon Redshift JDBC Driver to version 2.3.0 or later immediately.
  • Audit application configurations that dynamically construct JDBC connection strings from user-supplied input to identify and sanitize potential injection vectors.
  • Review AWS credentials profile configuration access to ensure they are not modifiable by untrusted processes or users.
]]>highadvisoryremote-code-executionjdbcamazon-redshiftcve-2026-119084