CVE-2026-8838
The Amazon Redshift Python driver before version 2.1.14 uses Python's eval() on data received from the server, allowing attackers to run arbitrary code on the client. This flaw can be exploited by a rogue server or a man‑in‑the‑middle attacker. The issue is fixed in driver version 2.1.14 and later.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Clients using the amazon-redshift-python-driver older than 2.1.14 when connecting to Amazon Redshift.
Real-world impact
An attacker who can influence the server’s data can execute any code on the client machine, potentially taking full control of the system.
Why this severity
The CVSS score of 9.3 reflects the high impact of arbitrary code execution (confidentiality, integrity, availability) combined with no authentication or user interaction required, making the vulnerability critical.
What to do about it
- 01Upgrade the amazon-redshift-python-driver to version 2.1.14 or later.
- 02Restart any applications or services that use the driver to ensure the new version is loaded.
NVD-referenced vendor advisory
Timeline
- May 18, 2026 · May 18, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.