Package vulnerability, severity medium

Amazon Redshift JDBC Driver RCE via unsafe class loading in connection parameters (CVE-2026-119084)

Published November 3, 2026

Amazon Redshift JDBC Driver versions before 2.3.0 could load and execute arbitrary classes when processing JDBC connection URL parameters or AWS credentials profile fields. An actor who can influence the connection URL or credentials profile could execute code in the application context. The issue is fixed in version 2.3.0.

What's affected

• com.amazon.redshift:redshift-jdbc42 (maven)<2.3.0

What to do

1. Upgrade Amazon Redshift JDBC Driver to version 2.3.0 or later.
2. Make sure any forked or derivative code is patched with the new fixes.
3. If you cannot upgrade immediately, do not build JDBC connection URLs or AWS credentials profiles from untrusted input.
4. Validate any externally supplied connection values against an allowlist of expected parameters and values.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident redshift-jdbc-driver-rce-2026-11

References

• https://aws.amazon.com/security/security-bulletins/rss/2026-168-aws/

Notice redshift-jdbc-driver-rce-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.