---
id: CVE-2026-119084
title: >-
  Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
  Connection Parameters
summary: >-
  Unsafe reflection in the connection parameter and credentials profile handling
  of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can
  influence the JDBC connection URL or the AWS credentials profile to execute
  arbitrary…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-470
vendor: AWS
product: amazon-redshift-jdbc-driver
affected:
  - amazon-redshift-jdbc-driver < 2.3.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T21:12:15.970Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119084'
references:
  - url: 'https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.3.0'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-168-aws/'
  - url: >-
      https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-qrph-v96m-w2mv
tags:
  - cve.org
epss: 0.00445
epssPercentile: 0.38813
ingestedAt: '2026-11-05T20:33:06.481Z'
---

## Overview

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.



To remediate this issue, users should upgrade to version 2.3.0 or later.

## Affected

- `amazon-redshift-jdbc-driver < 2.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.