VulnerabilityAwaiting Analysis

CVE-2026-8178

Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters.

CRITICAL 9.2EPSS 0.57%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

CVSS 4.0: 9.2 CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.57% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-470
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.