PT-2026-45695 · Apache · Apache Calcite

4Ra1N + 2 · Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-46718

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Calcite versions 1.5.0 through 1.41

Description An unsafe reflection issue exists where externally-controlled input can be used to select classes or code. Specifically, a user-controlled model can load arbitrary classes, which may lead to remote code execution.

Recommendations Upgrade to version 1.42.

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-46718

Affected Products

Apache Calcite

References · 4

• https://lists.apache.org/thread/9s37svo343w5ck1ovh478lkzcqk4949v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46718 · Security Note
• http://openwall.com/lists/oss-security/2026/06/01/7 · Note
• https://twitter.com/oss_security/status/2061650461854241140 · Twitter Post