Executive brief
The Amazon Redshift JDBC Driver, which allows applications to connect to Redshift data warehouses, contains a security flaw in how it handles connection settings. An attacker who can control the database connection string used by an application could force the driver to load and run malicious code. This could lead to a full takeover of the server or application using the driver, potentially exposing sensitive data or disrupting business operations.
Technical details
A remote code execution vulnerability exists in the Amazon Redshift JDBC Driver prior to version 2.2.2. The flaw stems from unsafe class loading during the processing of JDBC connection URL parameters. An attacker capable of influencing the connection string—such as through a web application that allows user-defined database connections—can trigger the driver to load and execute arbitrary Java classes. This occurs within the security context of the application using the driver. The issue is resolved in version 2.2.2.
Affected products
- Amazon Redshift JDBC Driver < 2.2.2
Timeline
- 2026-05-08: disclosed
- 2026-05-08: patched: Fixed in version 2.2.2