CVE-2026-8178 HIGH

CVE-2026-8178: Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

Weakness CWE-470
Published May 8, 2026
Last update May 8, 2026

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 8, 2026 Record updated