Live › vulnerability › GHSA-25hh-xvj4-2cqv
Go to dashboardThe experimental @aws-cdk/aws-redshift-alpha constructs build SQL for Redshift users, tables and privileges from user names, comments and passwords without escaping. Crafted values can change the SQL that runs with Redshift superuser privileges during deployment, including granting access to all cluster users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:08 UTC. All times on this page are UTC.
Teams whose CDK application uses the experimental @aws-cdk/aws-redshift-alpha constructs for Redshift users, tables or privileges, below version 2.274.0. Exposure depends on whether values such as user names, comments or passwords come from outside the developer's control. Teams that only write these values themselves and do not use the alpha module can skip it.
No product ranges from the sources yet.
npm ls @aws-cdk/aws-redshift-alpha@aws-cdk/aws-redshift-alpha to 2.274.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT
Description:
The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting the issue requires the ability to influence the CDK application's construct property values.
Impacted versions: <2.274.0-alpha.0
Resolution:
This issue has been addressed in @aws-cdk/aws-redshift-alpha version 2.274.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. After upgrading, review existing table grants to PUBLIC.
Workarounds:
Use only trusted, developer-authored values for user names, comments and passwords in these constructs, and review existing table grants to PUBLIC.
References:
Acknowledgement:
We would like to thank Joseph Semaan for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-25hh-xvj4-2cqv")