Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Wednesday 4 November
Global

Your region, kept on this device.

DonateGet the appSign in
Vulnerability

CVE-2026-119084

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

CVSS score (v4.0)9.2Critical
Not on CISA KEV list

Am I affected?

Sign in and add the software you use to your watchlist: we check it against every new vulnerability.

Show me how to fix it

Timeline

  1. Published by NVD
  2. Last updated by NVD
  3. First covered by RedTeamDaily

Coverage

AWS Security Bulletins· · High

AWS warns of remote code execution flaw in Amazon Redshift JDBC driver

AWS has published bulletin 2026-168-AWS for CVE-2026-119084, an issue in the Amazon Redshift JDBC Driver before version 2.3.0. Under certain conditions, the driver could load and execute arbitrary classes while processing JDBC connection URL parameters or AWS credentials profile fields, allowing remote code execution.

Am I affected?
Ask
1

Sources: NVD and CISA known exploited vulnerabilities catalogue.