Executive brief
Apache Calcite, a framework used by many database systems to manage and optimize data queries, contains a security flaw in how it handles user-provided data models. An attacker can provide a specially crafted model that forces the software to load unauthorized Java classes. This could allow an attacker to execute malicious code on the server or gain unauthorized access to sensitive data.
Technical details
Apache Calcite is vulnerable to 'Unsafe Reflection' (CWE-470) within its model parsing component (calcite-core). The vulnerability exists because the framework uses externally-controlled input from a schema model to select and load Java classes (such as user-defined functions, JDBC drivers, or custom schemas) without sufficient validation or denylisting. An attacker who can provide a malicious model—for example, via a JDBC connection string or an inline model parser—can trigger the loading of arbitrary classes. This can be leveraged to achieve remote code execution (RCE) or unauthorized data access. The fix, introduced in version 1.42.0, implements a built-in denylist of restricted class patterns and provides a system property to extend this list.
Affected products
- Apache Calcite 1.5.0 to 1.41.0
Timeline
- 2026-05-16: other: Initial fix development started
- 2026-06-01: disclosed: Public disclosure on oss-security mailing list
- 2026-06-02: advisory: GitHub and NVD advisories published
- 2026-07-09: patched: GitHub advisory reviewed and updated with patch details