PT-2026-136670

CVE-2026-119084

Published

2026-11-03

Updated

2026-11-05

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver versions prior to 2.3.0

Description Unsafe reflection occurs during the processing of the JDBC connection URL and AWS credentials profile resolution. An actor capable of influencing the connection parameter or the credentials profile can load and instantiate an arbitrary class available on the application classpath, potentially leading to remote code execution within the application context.

Recommendations Upgrade to version 2.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

4Ra1N

Unam4

Vendors

Affected products

Weakness enumeration

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')