Unsafe Reflection Vulnerability in Apache Calcite Avatica

CVE-2026-70410

What is CVE-2026-70410?

A vulnerability in Apache Calcite Avatica allows for unsafe reflection through external input in plugin instantiation methods like AvaticaUtils#instantiatePlugin. This permits potentially arbitrary classes to be initialized without proper restrictions, which can unintentionally trigger static initializers present in those classes. Although the likelihood of exploitation is mitigated due to the absence of widely used classes with harmful static initializers, users are advised to upgrade to version 1.29.0 to eliminate this risk.

References