CRITICAL 9.2 NVD
CVE-2026-119084
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influenc
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.
To remediate this issue, users should upgrade to version 2.3.0 or later.
References
- https://aws.amazon.com/security/security-bulletins/2026-168-aws/
- https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.3.0
- https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-qrph-v96m-w2mv
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-11-03 via NVD.
Risk Timeline
CVE Disclosed2026-11-03 · 0 days ago
Remediation Resources
vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.