AWS CDK @aws-cdk/aws-redshift-alpha: SQL injection in database-query handlers
Summary
The experimental Redshift constructs of the AWS Cloud Development Kit (CDK) build SQL statements from user names, comments and passwords without proper sanitisation. An attacker who can influence construct property values can run SQL statements with Amazon Redshift superuser privileges during deployment, including granting access to all cluster users. Exploitation requires the ability to influence the CDK application's input values, so exposure is limited to deployment pipelines that accept untrusted input.
Affected
- @aws-cdk/aws-redshift-alpha versions before 2.274.0-alpha.0
- Default: unaffected per CVE record
Fixed in
- Upgrade to @aws-cdk/aws-redshift-alpha 2.274.0-alpha.0 or later (AWS bulletin states version 2.274.0)
Workaround
- Use only trusted, developer-authored values for user names, comments and passwords in these constructs
- Review existing table grants to PUBLIC
Exploitation
- AWS does not state that the issue is exploited
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in CISA KEV according to a third-party report (unverified)
- No public exploit known; one unverified aggregator mentions a public scanning template
Our recommendation
- Check repositories and lockfiles for @aws-cdk/aws-redshift-alpha versions below 2.274.0-alpha.0 and upgrade
- Check internal forks or copied constructs and patch them as well
- Review table grants to PUBLIC on Redshift clusters deployed with these constructs
- Ensure that deployment inputs such as names, comments and passwords come only from trusted sources
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-151-AWS aws.amazon.com
- GitHub Security Advisory GHSA-25hh-xvj4-2cqv github.com
- AWS CDK Release v2.274.0 github.com
- VulDB entry CVE-2026-115418 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 22:06.
Original description (NVD)
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.