Executive brief
Apache Calcite Avatica is a SQL query execution framework used in database connectivity layers. A vulnerability in plugin instantiation allows attackers to instantiate arbitrary classes on the classpath through unsafe reflection, potentially triggering malicious code in class static initializers. This could lead to remote code execution depending on what dangerous classes are available in the application's classpath.
Technical details
The vulnerability exists in AvaticaUtils#instantiatePlugin and related methods that use Class.forName(String) without restricting instantiation to classes implementing the specified plugin interface. An attacker who can control the classname parameter can trigger static initializer blocks in arbitrary classes present on the classpath. The issue requires network access to invoke the affected APIs and affects versions before 1.29.0.
Affected products
- Apache Calcite Avatica before 1.29.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: version 1.29.0 fixes the issue