CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-109-aws/	Patch Vendor Advisory
https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0	Release Notes Vendor Advisory
https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:advanced_jdbc_wrapper:*:*:*:*:*:*:*:*

History

16 Sep 2026, 14:03

Type	Values Removed	Values Added
First Time		Amazon advanced Jdbc Wrapper Amazon
CPE		cpe:2.3:a:amazon:advanced_jdbc_wrapper::::::::
References	~~() https://aws.amazon.com/security/security-bulletins/2026-109-aws/ -~~	() https://aws.amazon.com/security/security-bulletins/2026-109-aws/ - Patch, Vendor Advisory
References	~~() https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0 -~~	() https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0 - Release Notes, Vendor Advisory
References	~~() https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9 -~~	() https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9 - Vendor Advisory

Information

Published : 2026-09-11 17:17

Updated : 2026-09-16 14:03

NVD link : CVE-2026-18061

Mitre link : CVE-2026-18061

CVE.ORG link : CVE-2026-18061

JSON object : View

Products Affected

amazon

advanced_jdbc_wrapper

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-18061", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18061", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-11T19:19:06.871633Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "AWS Advanced JDBC Wrapper", "versions": [{"status": "affected", "version": "3.3.0", "versionType": "custom", "lessThanOrEqual": "4.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-11T17:17:08.927", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-109-aws/", "tags": ["Patch", "Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0", "tags": ["Release Notes", "Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.\n\n\n\nTo remediate this issue, users should upgrade to version 4.3.0 or later."}], "lastModified": "2026-09-16T14:03:36.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:advanced_jdbc_wrapper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E40F6ED-53DA-4802-AC9F-3148D42821B2", "versionEndExcluding": "4.3.0", "versionStartIncluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}