CVE-2026-18061

medium

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with…

Vendor / product: Amazon — advanced jdbc wrapper

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.

CVSS

5.9

5.9 (CVSS v3.1)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

Severity source: NVD CVSS v3.1 (ff89ba41-3aa1-4d27-914a-91399e9639e5)

Timeline (UTC)

Published: 2026-09-11 17:17

Modified: 2026-09-16 14:03

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 06:52 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

amazon / advanced_jdbc_wrapper ≥3.3.0 <4.3.0

Weakness classification (CWE)

CWE-611

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://aws.amazon.com/security/security-bulletins/2026-109-aws/

Vendor advisory: https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0

Vendor advisory: https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9

Patch / mitigation: https://aws.amazon.com/security/security-bulletins/2026-109-aws/

References

https://aws.amazon.com/security/security-bulletins/2026-109-aws/ ff89ba41-3aa1-4d27-914a-91399e9639e5
https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0 ff89ba41-3aa1-4d27-914a-91399e9639e5
https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9 ff89ba41-3aa1-4d27-914a-91399e9639e5

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-18061

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs