AmazonAnalysisAWS patches unsafe class loading RCE in Amazon Redshift JDBC Driver
What happened.Amazon Web Services released security bulletin 2026-168-AWS addressing an unsafe class loading flaw in the Amazon Redshift JDBC Driver.
Why it matters.Database drivers operate within high-trust application contexts executing data transformations and administrative queries. When connection string parsers execute unvetted class constructors through dynamic reflection, malicious database connection strings compromise underlying application servers. Data platform engineers must update the Redshift JDBC Driver across ingestion pipelines and analytics clusters. Security teams should sanitize connection string inputs supplied through untrusted configuration portals.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-119084, the defect allows arbitrary class loading during connection string parameter and credentials profile parsing.
- Client execution: Attackers capable of influencing JDBC connection parameters or configuration profiles can trigger arbitrary code execution in calling client runtimes.
- Supply chain risk: The driver is embedded across enterprise ETL data pipelines, analytics workbenches, and business intelligence connection pools.
- Affected releases: All Amazon Redshift JDBC Driver builds prior to version 2.3.0 are vulnerable to parameter-driven class execution.
- Remediation release: AWS published Redshift JDBC Driver version 2.3.0, disabling dynamic reflection and validating all connection profile parameters.