PT-2026-39186 · Amazon · Amazon Redshift Jdbc Driver

Fushuling · Published 2026-05-08 · Updated 2026-05-28 · CVE-2026-8178

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver versions prior to 2.2.2

Description An issue allows the driver to load and execute arbitrary classes when processing JDBC connection URL parameters. An actor capable of influencing the connection URL could potentially execute code within the application context, provided a suitable class exists on the application's classpath.

Recommendations Upgrade to version 2.2.2 or later.

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-8178

GHSA-WMMV-VVG5-993Q

Affected Products

Amazon Redshift Jdbc Driver

References · 16

• https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2 · Patch
• https://osv.dev/vulnerability/GHSA-wmmv-vvg5-993q · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-028-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8178 · Security Note
• https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-wmmv-vvg5-993q · Note
• https://github.com/aws/amazon-redshift-jdbc-driver · Note
• https://t.me/CVEtracker/53153 · Telegram Post
• https://twitter.com/CVEnew/status/2053131458617962840 · Twitter Post
• https://twitter.com/integ_sec/status/2059971720019120237 · Twitter Post
• https://twitter.com/dailytechonx/status/2055695531926515900 · Twitter Post
• https://twitter.com/dailycve/status/2054949409071206517 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2055100782664700118 · Twitter Post
• https://twitter.com/UpwindMDR/status/2054921549388374027 · Twitter Post
• https://twitter.com/threatcluster/status/2055257101270749535 · Twitter Post
• https://twitter.com/UpwindMDR/status/2052842488298123761 · Twitter Post