CVE-2026-8838 Details
Description
Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.
A remote code execution vulnerability has been identified in the official Python connector for Amazon Redshift, specifically in versions through 2.1.13. This issue arises from the unsafe use of Python's eval() function on data received from the server, allowing a rogue server or man-in-the-middle actor to execute arbitrary code on the client. The vulnerability is exploited by sending specially crafted query responses that the driver processes without adequate input validation, potentially leading to unauthorized command execution, file system access, or credential theft with the privileges of the client application.
Users are advised to upgrade to version 2.1.14 of the Amazon Redshift Python Driver. Instructions for upgrading can be found on the Python Package Index (PyPI) website.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | AMZN |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | AMZN |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | AMZN |