Unsafe Reflection Vulnerability in Amazon Redshift JDBC Driver
CVE-2026-119084

9.2CRITICAL

Key Information:

Vendor

Aws

Status
Amazon-redshift-jdbc-driver
Vendor
CVE Published:
3 November 2026

What is CVE-2026-119084?

The Amazon Redshift JDBC Driver prior to version 2.3.0 is susceptible to an unsafe reflection vulnerability related to its connection parameter and AWS credentials profile management. This vulnerability could potentially allow an attacker, who can manipulate the JDBC connection URL or the AWS credentials profile, to execute arbitrary code within the application's environment if the appropriate class is present on the application classpath. To mitigate this risk, it is imperative for users to upgrade to version 2.3.0 or higher.

Affected Version(s)

amazon-redshift-jdbc-driver 0 < 2.3.0

References

https://github.com/aws/amazon-redshift-jdbc-driver/releas...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/aws/amazon-redshift-jdbc-driver/securi...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.