Executive brief
The official Python driver for Amazon Redshift contains a vulnerability that allows for remote code execution on the computer running the driver. If an application using this driver connects to a malicious server or is intercepted by an attacker, the attacker can execute commands, steal credentials, or access files on the client system. This poses a significant risk to any application or developer environment that interacts with Redshift databases using the affected library.
Technical details
A code injection vulnerability exists in the amazon-redshift-python-driver (redshift-connector) due to the unsafe use of the Python eval() function within the vector_in() component. When the driver processes query results from a server, it fails to sufficiently validate the incoming data before evaluation. An attacker capable of acting as a rogue server or performing a man-in-the-middle (MITM) attack on the PostgreSQL wire protocol can send crafted responses to trigger arbitrary code execution within the context of the client application. This vulnerability is tracked as CVE-2026-8838 and is resolved in version 2.1.14.
Affected products
- AWS redshift-connector <= 2.1.13
Timeline
- 2026-05-18: disclosed: Initial disclosure by AWS and NVD
- 2026-05-18: patched: Version 2.1.14 released
- 2026-05-29: advisory: GitHub Advisory published/reviewed
References
- https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-29h4-r29x-hchv
- https://aws.amazon.com/security/security-bulletins/2026-033-aws
- https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14
- https://api.github.com/repos/aws/amazon-redshift-python-driver/security-advisories/GHSA-29h4-r29x-hchv