CVE-2026-8178 json
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
published 2026-05-08 6 mo ago modified 2026-10-26 13 d ago also GHSA-wmmv-vvg5-993q , EUVD-2026-28814
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.
To mitigate this issue, users should upgrade to version 2.2.2 or later.
Patch / fix
- maven com.amazon.redshift:redshift-jdbc42 2.2.2
- Amazon Amazon Redshift JDBC Driver 2.2.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.amazon.redshift:redshift-jdbc42 | <2.2.2 |
2.2.2 |
Affected products
- Amazon Amazon Redshift JDBC Driver
Classification
- Weakness
-
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code
References
-
github.com
/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2
patch, web
-
aws.amazon.com
/security/security-bulletins/2026-028-aws/
vendor-advisory
-
github.com
/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-wmmv-vvg5-993q
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-8178
advisory
-
aws.amazon.com
/security/security-bulletins/2026-028-aws
web
-
github.com
/aws/amazon-redshift-jdbc-driver
package
Sources
- CVE List CVE-2026-8178
- GitHub Advisory GHSA-wmmv-vvg5-993q
- NVD CVE-2026-8178
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.