External risk intelligence

Amazon Redshift JDBC Driver Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-119084

The vulnerability affects a JDBC driver, which is a client-side library used by applications to connect to a database. It is not a service or network-facing component itself. While it could theoretically be reachable if an application dynamically constructs connection strings from untrusted external input, it is not a public-facing service by design or common deployment.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in the Amazon Redshift JDBC Driver that could allow an attacker to execute arbitrary code if they can control the JDBC connection URL or AWS credentials profile and if specific classes are available. This issue affects older versions of the driver and has been addressed in version 2.3.0 and later.

Code execution risk in data connection handling.
Affects applications connecting to Amazon Redshift.
Confirm driver versions and update as needed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by influencing the JDBC connection URL or AWS credentials profile of an application using an affected Amazon Redshift JDBC Driver. If a suitable class is available on the application's classpath, this could lead to arbitrary code execution within the application's context.

Attacker influences connection URL or credentials.
Vulnerable component handles connection parameters unsafely.
Allows arbitrary code execution in application.

Live Threat

Current exploitation, exposure, and threat context

An actor influencing the JDBC connection URL or AWS credentials could potentially execute arbitrary code. This occurs when the application's classpath contains a suitable class for the unsafe reflection in handling connection parameters and credentials profiles.

Application code execution
Unsafe reflection on parameters
Sensitive data compromise

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Amazon Redshift JDBC Driver impacts applications that use it to connect to databases. Application owners or the teams responsible for managing the application's dependencies are likely to own this issue. The first practical step is to identify all applications using the affected driver, determine if they are exposed to untrusted input that can influence the connection URL or credentials, and then plan remediation by upgrading the driver.

Application owners should own this issue.
Verify applications using the affected driver.
Upgrade the JDBC driver to a secure version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amazon Redshift JDBC Driver used for?

The Amazon Redshift JDBC Driver is a software library that enables Java-based applications to communicate with Amazon Redshift data warehouses. Developers integrate this driver into their applications so they can query, insert, or manage data stored in Redshift databases. It acts as the bridge between the application code and the database infrastructure.

How does CVE-2026-119084 create a security risk?

This vulnerability is classified as improper control of dynamically-managed code, or unsafe reflection (CWE-470). It means the driver may incorrectly interpret malicious instructions hidden within connection strings or credential profiles. If these inputs trigger the driver to use certain classes already present in the application's environment, it can execute unauthorized commands.

Can any application using the driver be compromised?

No. The issue requires specific preconditions. An attacker must be able to influence the JDBC connection URL or the AWS credentials profile used by the application. Furthermore, the application's classpath must contain specific classes that can be leveraged by the driver's reflection process. If an application uses only hardcoded, trusted connection parameters, the risk is significantly minimized.

Is my system at risk if I use the Amazon Redshift JDBC Driver?

According to Halo Surface Signal, this is considered unlikely for most environments. Because the driver is a client-side library and not a standalone network service, it is not inherently public-facing. Risk primarily exists only if your application dynamically builds database connection strings based on untrusted or external user input.

How do I secure my environment against this vulnerability?

The primary response is to update the Amazon Redshift JDBC Driver to version 2.3.0 or later. Before updating, audit your applications to identify those utilizing older versions of the driver. Prioritize updating any applications that construct database connections using external or user-provided data, as these are the most critical to secure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.