---
id: CVE-2026-8178
title: Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
summary: >-
  An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under
  certain conditions, the driver could load and execute arbitrary classes when
  processing JDBC connection URL parameters. An actor who can influence the
  connecti…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-470
vendor: Amazon
product: Amazon Redshift JDBC Driver
affected:
  - redshift_jdbc_driver < 2.2.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-08T20:06:23.595236Z'
published: '2026-05-08'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:14:43.609Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-8178'
references:
  - url: 'https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-028-aws/'
  - url: >-
      https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-wmmv-vvg5-993q
tags:
  - cve.org
epss: 0.00711
epssPercentile: 0.52768
ingestedAt: '2026-10-20T19:16:14.556Z'
---

## Overview

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.



To mitigate this issue, users should upgrade to version 2.2.2 or later.

## Affected

- `redshift_jdbc_driver < 2.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.