Vulnerability · Published May 8, 2026 · Assigned by AMZN

CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

High 8.1

In plain English

A high-severity security flaw in Amazon Redshift JDBC Driver from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.amazon.redshift:redshift-jdbc42	2.2.2	GHSA-wmmv-vvg5-993q

Affected products (as reported)

Vendor	Product	Versions
Amazon	Amazon Redshift JDBC Driver	0 – before 2.2.2

Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2 patch
https://aws.amazon.com/security/security-bulletins/2026-028-aws/ vendor-advisory
https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-wmmv-vvg5-993q third-party-advisory