SQL Injection Vulnerability in AWS Cloud Development Kit Redshift Module
CVE-2026-115418

7HIGH

Key Information:

Vendor

Aws

Status
Aws-cdk/aws-redshift-alpha
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115418?

A SQL injection vulnerability exists in the AWS Cloud Development Kit (CDK) for the Redshift module, where unvalidated user inputs can be exploited by a malicious party to execute SQL statements with superuser privileges. This can potentially allow unauthorized access to database resources and manipulation of user privileges. Administrators should upgrade to version 2.274.0-alpha.0 or later and carefully reassess the grants of existing tables to safeguard their environment from potential attacks.

Affected Version(s)

aws-cdk/aws-redshift-alpha 0 < 2.274.0-alpha.0

References

https://github.com/aws/aws-cdk/releases#release-v2.274.0
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.