CVE-2026-8178 | THREATINT

Description

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

PUBLISHED Reserved 2026-05-08 | Published 2026-05-08 | Updated 2026-05-08 | Assigner AMZN

HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CRITICAL: 9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-470: Use of Externally-Controlled Input to Select Classes or Code

Product status

Default status

unaffected

2.2.2

unaffected

References

github.com/...mazon-redshift-jdbc-driver/releases/tag/v2.2.2 patch

aws.amazon.com/security/security-bulletins/2026-028-aws/ vendor-advisory

github.com/...driver/security/advisories/GHSA-wmmv-vvg5-993q third-party-advisory

cve.org (CVE-2026-8178)

nvd.nist.gov (CVE-2026-8178)

Download JSON