CVE-2026-18061
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.
Risk Assessment
An attacker with write access to the shared cache can exfiltrate database and IAM credentials, potentially leading to full compromise of the cloud environment.
Recommendation
Upgrade AWS Advanced JDBC Wrapper to version 4.3.0 or later. Restrict write access to the shared cache infrastructure to trusted actors.
Other vulnerabilities in AWS Advanced JDBC Wrapper
Original NVD description (English source)
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS