Remote Code Execution in amazon-redshift-python-driver

Bulletin ID: 2026-033-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/18/2026 13:15 PM PDT   Description: amazon-redshift-python-driver is the official Python connector for Amazon Redshift. We identified a code injection issue in versions 2.1.13 and earlier that could allow a rogue server or man-in-the-middle to execute arbitrary code on the client. Impacted versions:   Resolution: This issue has been addressed in amazon-redshift-python-driver version 2.1.14 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. References: redshift-connector 2.1.14 CVE-2026-8838 GHSA-29h4-r29x-hchv Acknowledgement: We would like to thank Kexin Chen and the Institute of Information Engineering, Chinese Academy of Sciences for collaborating through the coordinated disclosure process. Please email aws-security@amazon.com with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-033-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-8838 - Remote Code Execution in amazon-redshift-python-driver Bulletin ID: 2026-033-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/18/2026 13:15 PM PDT   Description: amazon-redshift-python-driver is the official Python connector for Amazon Redshift. We identified a code injection issue in versions 2.1.13 and earlier that could allow a rogue server or man-in-the-middle to execute arbitrary code on the client. Impacted versions:   Resolution: This issue has been addressed in amazon-redshift-python-driver version 2.1.14 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. References: redshift-connector 2.1.14 CVE-2026-8838 GHSA-29h4-r29x-hchv Acknowledgement: We would like to thank Kexin Chen and the Institute of Information Engineering, Chinese Academy of Sciences for collaborating through the coordinated disclosure process. Please email aws-security@amazon.com with any security questions or concerns.   {"data":{"items":[{"fields":{"footer":"{ "createAccountButtonLabel": "Create an AWS account", "createAccountButtonURL": "https://signin.aws.amazon.com/signup?request_type=register", "backToTopText": "Back to top", "eoeText": "Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability or other legally protected status. Veterans, military spouses, and people with disabilities are encouraged to apply.", "copyrightText": "© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.", "items": [ { "name": "Learn", "linkURL": "", "items": [ { "heading": "What Is AWS?", "linkURL": "/what-is-aws/?nc1=f_cc" }, { "heading": "What Is Cloud Computing?", "linkURL": "/what-is-cloud-computing/?nc1=f_cc" }, { "heading": "What Is Agentic AI?", "linkURL": "/what-is/agentic-ai/?nc1=f_cc" }, { "heading": "Cloud Computing Concepts Hub", "linkURL": "/what-is/?nc1=f_cc" }, { "heading": "AWS Cloud Security", "linkURL": "/security/?nc1=f_cc" }, { "heading": "What's New", "linkURL":

Severity from

no source yet

• aws.amazon.com/security/security-bulletins/rss/2026-033-aws/
• www.cve.org/CVERecord?id=CVE-2026-8838