CVE Intelligence
Analysis AI-assisted

CVE-2026-8838: Amazon Redshift Python Driver: unsafe eval() in vector_in enables client-side code execution

CVE-2026-8838 affects amazon-redshift-python-driver before 2.1.14. The vector_in() function applies Python's eval() to data received from a server, which the record says could let a rogue server or man-in-the-middle actor run arbitrary code on the client. The CNA-provided CVSS 3.1 base score is 9.8 (critical), and the record advises upgrading to 2.1.14.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-8838 affects the amazon-redshift-python-driver package. According to the record, the vector_in() function passes data received from a server to Python's eval(), which can allow a rogue server or a man-in-the-middle actor to run arbitrary code on the client. The record maps the weakness to CWE-94 (Code Injection).

Impact

  • The record describes potential arbitrary code execution on the client system running the driver.
  • The CNA-provided CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates a network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
  • The CNA also lists a CVSS 4.0 base score of 9.3.

Affected products and versions

  • The description identifies versions before 2.1.14 of amazon-redshift-python-driver as affected.
  • The structured affected and fixes fields in the record are empty, so a precise list of affected version ranges and product identifiers is unknown beyond the description.

Exploitation status

  • The KEV entry in the record shows listed as false. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability in the record is 0.00803 with a percentile of 0.5555.

Remediation and mitigation

  • The record advises users to upgrade to version 2.1.14.
  • Review the maintainer's GitHub security advisory and release page for details on the fix and any additional guidance.
  • If an upgrade cannot be applied immediately, reduce exposure by connecting only to trusted database endpoints over verified encrypted connections, and review how applications built on the driver handle server-supplied data. This is a general defensive inference, not a vendor recommendation.

Detection guidance

  • Inventory Python environments and dependency manifests to identify installed versions of the driver.
  • Monitor applications that use the driver for unexpected child processes or outbound network connections.
  • Review logs for connections to database endpoints that are not part of approved infrastructure.

Limitations of the available information

  • The record does not provide a detailed technical root cause beyond the description, nor the exact conditions required for exploitation.
  • The affected and fixes fields are empty, and the source status is Awaiting Analysis.
  • The content of the AWS security bulletin was not included in the record, only its link.

Frequently asked questions

What is the risk of CVE-2026-8838?

The record describes a code injection flaw that could let a rogue server or man-in-the-middle actor run arbitrary code on the client. The CNA lists a CVSS 3.1 base score of 9.8 (critical).

Which version fixes CVE-2026-8838?

The record advises upgrading amazon-redshift-python-driver to version 2.1.14, which is the first version stated as not affected by the description.

Is CVE-2026-8838 known to be exploited?

The KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.