CVE-2026-115418

Name of the Vulnerable Software and Affected Versions @aws-cdk/aws-redshift-alpha versions prior to 2.274.0-alpha.0

Description SQL injection exists in the database-query custom resource handlers. A third party capable of influencing construct property values can execute SQL statements with Amazon Redshift superuser privileges, which may include granting access to all cluster users. This is possible through crafted user names, comments, or passwords.

Recommendations Upgrade to version 2.274.0-alpha.0 or later. Review existing table grants to PUBLIC. Treat construct values originating from config files or pipeline inputs as untrusted.