AWSAWS-2026-168

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection...

CVE-2026-119084 · Published Nov 3, 2026

High8.1

No fix yet

Bulletin ID: 2026-168-AWS Publication Date: 11/03/2026 13:00 PM PST Description: We identified CVE-2026-119084, an issue in Amazon Redshift JDBC Driver versions prior to 2.3.0. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters or AWS credentials profile fields. Impacted versions: Amazon Redshift JDBC Driver < 2.3.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityNov 4Severity: Unrated to High

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: NVD

More AWS advisories

All AWS

High 7.8Nov 3

AWS API MCP Server OAuth token audience validation bypassCVE-2026-115413no fix yet Medium 5.4Nov 3

Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingCVE-2026-121652no fix yet High 8.8Nov 3

Babelfish for PostgreSQL Privilege EscalationCVE-2026-119922no fix yet Medium 6.5Nov 2

Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yet Medium 6.1Nov 2

Improper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yet Medium 5.0Nov 2

Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yet