{"id":"CVE-2026-115418","kind":"vulnerability","aliases":["CVE-2026-115418"],"related":[],"title":"SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit…","description":"CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)\n\n### CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)\n\nBulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT\n\nDescription:\n\nThe AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting the issue requires the ability to influence the CDK application's construct property values.\n\nImpacted versions: <2.274.0-alpha.0\n\nResolution:\n\nThis issue has been addressed in @aws-cdk/aws-redshift-alpha version 2.274.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. After upgrading, review existing table grants to PUBLIC.\n\nWorkarounds:\n\nUse only trusted, developer-authored values for user names, comments and passwords in these constructs, and review existing table grants to PUBLIC.\n\nReferences:\n\n- CVE-2026-115418\n- GHSA-25hh-xvj4-2cqv\n- https://www.npmjs.com/package/@aws-cdk/aws-redshift-alpha\n\nAcknowledgement:\n\nWe would like to thank Joseph Semaan for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The experimental @aws-cdk/aws-redshift-alpha constructs build SQL for Redshift users, tables and privileges from user names, comments and passwords without escaping. Crafted values can change the SQL that runs with Redshift superuser privileges during deployment, including granting access to all cluster users.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-cdk","infrastructure-as-code","lab-disclosure","package","redshift"],"not_affected_if":["developer-authored-values-only","no-redshift-alpha-constructs"],"how_to_check":"- Check the installed version with `npm ls @aws-cdk/aws-redshift-alpha`, and treat anything below `2.274.0-alpha.0` as affected.\n- Search the CDK app for uses of the Redshift alpha user, table or privilege constructs.\n- Look for user names, comments or passwords that come from input outside the developer's control.","fix":"- Upgrade `@aws-cdk/aws-redshift-alpha` to `2.274.0` or later.\n- Patch any forked or derivative copies of the code.\n- After upgrading, review existing table grants to PUBLIC.\n- Until upgraded, use only developer-authored values for user names, comments and passwords.","status":"open","published_at":"2026-10-26T00:00:00+00:00","first_seen_at":"2026-10-26T17:08:20+00:00","triaged_at":"2026-10-26T17:10:10+00:00","updated_at":"2026-10-26T17:31:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T17:10:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@aws-cdk/aws-redshift-alpha` to `2.274.0` or later.\n- Patch any forked or derivative copies of the code.\n- After upgrading, review existing table grants to PUBLIC.\n- Until upgraded, use only developer-authored values for user names, comments and passwords.","reach":"unknown","title":"AWS CDK Redshift alpha module: SQL injection grants superuser-level SQL at deploy","impact":"high","summary":"The experimental @aws-cdk/aws-redshift-alpha constructs build SQL for Redshift users, tables and privileges from user names, comments and passwords without escaping. Crafted values can change the SQL that runs with Redshift superuser privileges during deployment, including granting access to all cluster users.","category":"package","nicknames":[],"who_cares":["aws-cdk","redshift","infrastructure-as-code","aws"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker-controlled SQL runs with Redshift superuser privileges during deployment","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @aws-cdk/aws-redshift-alpha`, and treat anything below `2.274.0-alpha.0` as affected.\n- Search the CDK app for uses of the Redshift alpha user, table or privilege constructs.\n- Look for user names, comments or passwords that come from input outside the developer's control.","needs_analyst":false,"not_affected_if":["no-redshift-alpha-constructs","developer-authored-values-only"],"who_is_affected":"Teams that deploy Amazon Redshift users, tables or privileges with the experimental @aws-cdk/aws-redshift-alpha constructs are exposed. Exposure requires that someone else can influence the construct property values, such as through externally supplied configuration or parameters. Apps that only use developer-authored literal values, or that do not use these constructs, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":3910,"output_tokens":709,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115418':22A,25A,85C,103C,165C,287C '-151':122C '-2026':21A,24A,84C,102C,164C,286C '/aws-redshift-alpha':44B,148C,228C '/package/@aws-cdk/aws-redshift-alpha':295C '09':134C '10/26/2026':133C '2.274.0':216C,230C '2026':121C '25hh':290C '2cqv':292C '30':135C 'abil':204C 'access':78B,194C 'acknowledg':296C 'address':223C 'alpha.0':217C 'amazon':13A,97C,115C,155C,186C 'applic':209C 'attent':130C 'author':266C 'aw':16A,26B,28B,42B,100C,118C,123C,125C,140C,146C,226C 'aws-cdk':27B,41B,145C,225C 'aws-security@amazon.com':317C 'build':46B 'bulletin':119C 'cdk':29B,43B,144C,147C,208C,227C 'chang':65B,180C 'cloud':17A,141C 'cluster':81B,197C 'code':33B,244C 'collabor':305C 'comment':57B,172C,271C 'concern':323C 'construct':45B,152C,178C,211C,276C 'content':126C 'coordin':311C 'could':179C 'craft':62B,169C 'custom':8A,93C,111C 'cve':20A,23A,83C,101C,163C,285C 'databas':6A,91C,109C 'database-queri':5A,90C,108C 'date':132C 'deploy':75B,191C 'deriv':243C 'descript':138C 'develop':18A,142C,265C 'developer-author':264C 'disclosur':36B,313C 'email':316C 'ensur':239C 'escap':61B 'exist':255C,279C 'experiment':40B,151C 'exploit':199C 'fix':251C 'fork':241C 'ghsa':289C 'ghsa-25hh-xvj4-2cqv':288C 'grant':77B,193C,257C,281C 'handler':10A,95C,113C 'id':120C 'identifi':162C 'impact':214C 'import':128C 'includ':76B,192C 'incorpor':248C 'influenc':206C 'infrastructur':31B 'infrastructure-as-cod':30B 'inject':2A,87C,105C 'issu':167C,201C,220C,308C 'joseph':302C 'kit':19A,143C 'lab':35B 'lab-disclosur':34B 'latest':236C 'like':299C 'manag':154C 'modul':149C 'name':56B,171C,270C 'new':250C 'packag':37B 'password':59B,174C,273C 'patch':246C 'pdt':137C 'pleas':315C 'privileg':53B,73B,160C,189C 'process':314C 'properti':212C 'provid':150C 'public':131C,259C,283C 'queri':7A,92C,110C 'question':321C 'recommend':232C 'redshift':38B,49B,71B,156C,187C 'refer':284C 'requir':129C,202C 'resolut':218C 'resourc':9A,94C,112C 'review':254C,278C 'run':69B,184C 'scope':124C 'secur':320C 'semaan':303C 'servic':15A,99C,117C 'set':175C 'sql':1A,47B,67B,86C,104C,182C 'superus':72B,188C 'tabl':51B,158C,256C,280C 'thank':301C 'trust':263C 'type':127C 'upgrad':233C,253C 'use':261C 'user':50B,55B,82B,157C,170C,198C,269C 'valu':63B,213C,267C 'version':215C,229C,237C 'vulner':312C 'web':14A,98C,116C 'without':60B 'workaround':260C 'would':298C 'www.npmjs.com':294C 'www.npmjs.com/package/@aws-cdk/aws-redshift-alpha':293C 'xvj4':291C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy Amazon Redshift users, tables or privileges with the experimental @aws-cdk/aws-redshift-alpha constructs are exposed. Exposure requires that someone else can influence the construct property values, such as through externally supplied configuration or parameters. Apps that only use developer-authored literal values, or that do not use these constructs, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-151-aws/#CVE-2026-115418","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-151-aws/","severity":null,"published_at":"2026-10-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-26T17:08:20+00:00","fetched_at":"2026-10-26T17:08:20+00:00","note":"AWS: CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)"},{"source":"nvd","external_id":"CVE-2026-115418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115418","severity":null,"published_at":"2026-10-26T17:17:16+00:00","modified_at":"2026-10-26T17:17:16+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[{"id":3989,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-151-aws/","title":"AWS: CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)","kind":"advisory","source":"lab","text":"CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)\n\n### CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)\n\nBulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT\n\nDescription:\n\nThe AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting the issue requires the ability to influence the CDK application's construct property values.\n\nImpacted versions: <2.274.0-alpha.0\n\nResolution:\n\nThis issue has been addressed in @aws-cdk/aws-redshift-alpha version 2.274.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. After upgrading, review existing table grants to PUBLIC.\n\nWorkarounds:\n\nUse only trusted, developer-authored values for user names, comments and passwords in these constructs, and review existing table grants to PUBLIC.\n\nReferences:\n\n- CVE-2026-115418\n- GHSA-25hh-xvj4-2cqv\n- https://www.npmjs.com/package/@aws-cdk/aws-redshift-alpha\n\nAcknowledgement:\n\nWe would like to thank Joseph Semaan for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-26T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}