AWS Fixes SQL Injection Flaw in CDK Redshift Module

Amazon Web Services (AWS) has disclosed and addressed a SQL injection vulnerability in the AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module. The issue could allow crafted usernames, comments, or passwords to alter SQL statements executed with Amazon Redshift superuser privileges during deployment.

Tracked as CVE-2026-115418, the vulnerability affects versions earlier than 2.274.0-alpha.0. According to AWS, exploitation requires the ability to influence construct property values in the CDK application.

The issue is important because the affected constructs manage Amazon Redshift users, tables, and privileges. If crafted property values change the SQL being executed, the resulting statements could grant access to all users in a cluster.

AWS has addressed the issue in @aws-cdk/aws-redshift-alpha version 2.274.0. The company recommends upgrading to the latest version, patching any forked or derivative code, and reviewing existing table grants to PUBLIC.

What Is CVE-2026-115418?

CVE-2026-115418 is a SQL injection vulnerability in the database-query custom resource handlers used by the AWS CDK @aws-cdk/aws-redshift-alpha module.

The module provides experimental constructs for managing Amazon Redshift users, tables, and privileges. The vulnerability occurs when crafted values supplied for certain construct properties can change the SQL statements generated and executed during deployment.

AWS identifies three affected input types:

• Usernames

• Comments

• Passwords

Exploitation depends on an attacker or another untrusted source being able to influence the relevant construct property values in a CDK application. AWS does not describe the issue as an attack that can be triggered by an arbitrary external request without that access.

The security concern is the privilege level at which the altered SQL runs. AWS states that the statements execute with Amazon Redshift superuser privileges and could include commands that grant access to all cluster users.

How the SQL Injection Vulnerability Works

SQL injection occurs when input values change the meaning of a SQL statement rather than being handled only as data. In this case, AWS says crafted values in certain CDK construct properties could change the SQL generated by the database-query custom resource handlers.

The affected code manages Redshift users, tables, and privileges. When the relevant constructs are used during deployment, their property values can influence the SQL that is executed.

If a crafted username, comment, or password changes the intended statement, the resulting SQL may run with Amazon Redshift superuser privileges. AWS specifically notes that this could include granting access to all cluster users.

The issue therefore involves more than incorrectly formatted input. The potential impact comes from altered SQL executing with elevated database privileges.

AWS states that exploitation requires the ability to influence the CDK application's construct property values. The bulletin does not disclose evidence of active exploitation or provide details about any confirmed incidents.

Affected Versions and Fixed Release

AWS identifies versions earlier than 2.274.0-alpha.0 as affected.

AWS recommends upgrading to the latest version of the module and ensuring that any forked or derivative code incorporates the fix.

Teams maintaining internal forks should not assume that upgrading the upstream package automatically patches their own modified code. They should confirm that the relevant changes have been incorporated.

AWS Remediation and Recommended Actions

AWS has addressed CVE-2026-115418 in @aws-cdk/aws-redshift-alpha version 2.274.0. Its bulletin identifies two key actions for users: upgrade the affected module and review existing table grants to PUBLIC.

1. Upgrade the Affected Module

Update @aws-cdk/aws-redshift-alpha to the latest version, following the release guidance provided by AWS.

Organizations should identify applications using the affected version range and confirm that their deployments use a patched release.

2. Patch Forked or Derivative Code

AWS explicitly recommends ensuring that forked or derivative code is patched to incorporate the new fixes.

This is relevant to teams that maintain their own copies or modifications of the affected module. Updating the original dependency alone may not update separately maintained code.

3. Review Existing Table Grants to PUBLIC

AWS recommends reviewing existing table grants to PUBLIC after upgrading.

This step matters because installing the fixed version does not itself remove grants that may already exist. The GitHub security advisory associated with the issue explicitly notes that existing grants must be reviewed separately.

Organizations should assess their existing grants and determine whether any permissions need to be changed. AWS does not provide a universal list of grants that should be removed, so the review should reflect each deployment's intended access requirements.

4. Use Trusted, Developer-Authored Values

AWS provides a workaround for deployments that cannot immediately upgrade: use only trusted, developer-authored values for usernames, comments, and passwords in the affected constructs.

The company also recommends reviewing existing table grants to PUBLIC as part of the workaround.

This measure reduces the risk associated with untrusted values influencing the construct properties. AWS nevertheless recommends upgrading to the fixed release.

What Developers and Cloud Security Teams Should Know

CVE-2026-115418 highlights the security implications of allowing input values to influence SQL executed with elevated database privileges.

For teams using the affected module, the immediate priority is to identify the deployed version, apply the available fix, and review existing permissions.

The incident also reinforces several general secure-development considerations:

• Treat construct properties as security-relevant inputs: Values passed into infrastructure code can affect operations performed during deployment.

• Avoid untrusted values in sensitive database constructs: AWS specifically recommends trusted, developer-authored values for the affected usernames, comments, and passwords.

• Review permissions separately from patching: Upgrading fixes the vulnerable code, but existing table grants to PUBLIC still require review.

• Check derivative code: Organizations maintaining forks should verify that they have incorporated the relevant fixes.

• Verify the actual dependency version: Teams should confirm that applications use a fixed release rather than relying on an assumed update.

These are practical implications of AWS's advisory, not claims that all CDK constructs or Amazon Redshift environments are affected.

Disclosure and Acknowledgement

AWS published Security Bulletin 2026-151-AWS on October 26, 2026, at 09:30 AM PDT. The bulletin classifies the issue as Important (requires attention).

AWS acknowledged Joseph Semaan for collaborating on the issue through its coordinated vulnerability disclosure process.

The company lists CVE-2026-115418, GitHub Security Advisory GHSA-25hh-xvj4-2cqv, and the npm package page for @aws-cdk/aws-redshift-alpha as references.

AWS has not disclosed additional incident details in the bulletin. Additional details were not disclosed in the announcement.

Conclusion

AWS has addressed CVE-2026-115418, a SQL injection vulnerability in the AWS CDK @aws-cdk/aws-redshift-alpha module. Crafted usernames, comments, or passwords could alter SQL executed with Amazon Redshift superuser privileges when an attacker can influence the relevant CDK construct property values.

The affected version range is earlier than 2.274.0-alpha.0, and AWS identifies version 2.274.0 as the release containing the fix. Users should upgrade, patch any forked or derivative code, and review existing table grants to PUBLIC.

For teams unable to upgrade immediately, AWS recommends using only trusted, developer-authored values for the affected properties and reviewing existing grants. These steps address the specific risks identified in the bulletin while helping teams maintain appropriate access controls in their Redshift environments.