CVE-2026-8178

HighCVSS 8.1

Published: 08/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

48th percentile - higher than 48% of all known CVEs

Summary

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2 that could allow arbitrary classes to be loaded and executed when processing JDBC connection URL parameters.

Risk Assessment

An actor who can influence the connection URL could potentially execute code in the application context, posing a significant security risk.

Recommendation

Users should upgrade to version 2.2.2 or later to mitigate this issue.

Other vulnerabilities in Amazon Redshift JDBC Driver

CVE-2026-119084High
Amazon Redshift JDBC Driver before 2.3.0 contains unsafe reflection in the handling of connection parameters and credentials profiles. An actor who can influence the JDBC connection URL or the AWS credentials profile may execute arbitrary code in the application context, provided a suitable class is available on the application classpath.

Original NVD description (English source)

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS