amazon aws CVE-2026-115418 in Amazon and Aws Products
Published on October 26, 2026

SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha

product logo product logo
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-115418 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a SQL Injection Vulnerability?

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE-2026-115418 has been classified to as a SQL Injection vulnerability or weakness.


Products Associated with CVE-2026-115418

stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Aws Cdk Aws Redshift Alpha. Just hit a watch button to start following.

Amazon Aws
 
Aws Cdk Aws Redshift Alpha
 

Affected Versions

aws-cdk/aws-redshift-alpha: