Executive brief
The AWS Advanced JDBC Wrapper is a library used by applications to connect to Amazon Aurora and RDS databases with enhanced features like automatic failover and query caching. When the optional RemoteQueryCachePlugin is enabled, an attacker with write access to the cache can inject malicious XML that, when parsed by the application, allows extraction of sensitive files and credentials (including database passwords and IAM role tokens) that the application can read.
Technical details
The vulnerability is an improper restriction of XML external entity references (CWE-611) in the RemoteQueryCachePlugin component of AWS Advanced JDBC Wrapper. The root cause is insufficient validation and entity resolution controls in the XML parsing logic used when deserializing cached column values. An attacker with write access to the shared cache infrastructure can inject malicious XML containing external entity declarations into cached data. When an application retrieves and parses this cached data as XML, the vulnerable parsers resolve the external entities, enabling XXE attacks such as file disclosure (reading local files accessible to the application process) and credential extraction. The attack requires the RemoteQueryCachePlugin to be explicitly enabled and the attacker to have write access to the cache. Patches are available in versions 4.2.1 and later.
Affected products
- AWS Advanced JDBC Wrapper >= 3.3.0, <= 4.2.0
Timeline
- 2026-09-11: disclosed: CVE-2026-18061 disclosed in AWS Security Bulletin 2026-109