CVE-2026-8838 CRITICAL

CVE-2026-8838: Remote Code Execution via eval() Injection in amazon-redshift-python-driver

Vendor Aws

Product Amazon Redshift connector for Python

Weakness CWE-94 · Code injection

Published May 18, 2026

Last update May 19, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

Description

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.

Key dates

Disclosure timeline

May 18, 2026 CVE published

May 19, 2026 Record updated