Vulnerability · Published May 18, 2026 · Assigned by AMZN

CVE-2026-8838Remote Code Execution via eval() Injection in amazon-redshift-python-driver

Critical 9.8

In plain English

A critical-severity code injection in Amazon Redshift connector for Python from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 43.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	redshift-connector	2.1.14	GHSA-29h4-r29x-hchv
PyPI	redshift-connector	2.1.14	PYSEC-2026-521

Affected products (as reported)

Vendor	Product	Versions
AWS	Amazon Redshift connector for Python	0 – through 2.1.13

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14 patch
https://aws.amazon.com/security/security-bulletins/2026-033-aws/ vendor-advisory
https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-29h4-r29x-hchv third-party-advisory