PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8838 AWS CVE debrief

CVE-2026-8838 is a critical client-side code execution issue in amazon-redshift-python-driver before 2.1.14. The flaw stems from unsafe use of Python eval() on data received from the server in vector_in(), which means a rogue server or man-in-the-middle actor could potentially trigger arbitrary code execution on the client. AWS and the GitHub advisory both direct users to upgrade to version 2.1.14.

Vendor
AWS
Product
Amazon Redshift connector for Python
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-19
Advisory published
2026-05-18
Advisory updated
2026-05-19

Who should care

Organizations and developers using amazon-redshift-python-driver, especially in environments where the client connects over untrusted networks, to servers that are not fully trusted, or through paths where interception is a concern. Security teams should prioritize any Python applications that use this driver.

Technical summary

The issue is described as unsafe use of Python eval() on server-received data in the vector_in() function. Because the input originates from the server side, an attacker who can impersonate or control that server, or intercept traffic as a man-in-the-middle, may be able to influence code execution on the client. NVD maps the weakness to CWE-94 (code injection). The vendor-fixed version is 2.1.14.

Defensive priority

Critical. This is a network-reachable code execution path on the client side, with no privileges or user interaction required in the supplied CVSS vector, and the described impact includes high confidentiality, integrity, and availability loss.

Recommended defensive actions

  • Upgrade amazon-redshift-python-driver to version 2.1.14 or later.
  • Audit applications that use this driver to identify exposure to untrusted or partially trusted network paths.
  • Treat any deployments that may connect through hostile networks or proxies as higher priority for remediation.
  • Review the AWS security bulletin and GitHub advisory for the vendor-confirmed fix details.
  • Revalidate dependency pins and lockfiles so vulnerable pre-2.1.14 versions are not reintroduced.

Evidence notes

Primary evidence comes from the NVD record for CVE-2026-8838, which cites the AWS security bulletin, the 2.1.14 GitHub release, and the GitHub security advisory. The supplied description explicitly states unsafe eval() on server-received data in vector_in() and identifies upgrade to 2.1.14 as the remediation. NVD metadata also lists CWE-94. The vendor field in the provided source data is low-confidence/needs review, but the referenced sources consistently point to AWS's amazon-redshift-python-driver.

Official resources

CVE-2026-8838 was published in NVD on 2026-05-18 and updated on 2026-05-19. The supplied sources identify amazon-redshift-python-driver version 2.1.14 as the fix and describe the flaw as unsafe eval() on server-received data in vector_in(),