CVE-2026-14265: AWS Advanced JDBC Wrapper RCE Flaw

CVE-2026-14265 Overview

CVE-2026-14265 is an insecure deserialization vulnerability [CWE-502] in the RemoteQueryCachePlugin component of the AWS Advanced JDBC Wrapper, versions 3.3.0 through 4.0.0. The plugin uses ObjectInputStream without class filtering when deserializing cached query results retrieved from Redis or Valkey. An actor with write access to the shared cache infrastructure can poison cache entries with crafted serialized Java objects. Applications reading those entries trigger gadget chain execution, resulting in arbitrary code execution on the application server.

Critical Impact
Attackers who can write to the shared Redis or Valkey cache can execute arbitrary Java code on any application server that reads poisoned cache entries via the AWS Advanced JDBC Wrapper.

Affected Products

AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0
Applications using the RemoteQueryCachePlugin with Redis backends
Applications using the RemoteQueryCachePlugin with Valkey backends

Discovery Timeline

2026-07-01 - CVE-2026-14265 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14265

Vulnerability Analysis

The AWS Advanced JDBC Wrapper is a Java Database Connectivity (JDBC) driver enhancement that provides features like connection pooling, failover, and query result caching. The RemoteQueryCachePlugin stores query results in an external cache backend such as Redis or Valkey, allowing multiple application servers to share cached results.

When the plugin retrieves a cached entry, it deserializes the byte stream using a raw ObjectInputStream without applying any allow-list or ObjectInputFilter. Java deserialization of untrusted data is a well-documented sink for gadget chain attacks, where classes present on the application classpath are chained together during object reconstruction to reach arbitrary method invocation.

Exploitation requires the attacker to have write access to the shared cache. This access can be obtained through unauthenticated Redis instances, leaked credentials, cache misconfigurations, or compromise of another workload sharing the cache tier.

Root Cause

The root cause is the absence of class filtering during deserialization. The plugin trusts the integrity and authenticity of cached bytes without validating the object types being reconstructed. Any gadget chain available on the JDBC application's classpath, such as Commons Collections, Spring, or Groovy, can be leveraged for code execution.

Attack Vector

An attacker first gains write access to the Redis or Valkey instance backing the plugin. The attacker writes a serialized Java payload to a key that the plugin will read as a cached query result. When any application server invokes a matching JDBC query, the plugin fetches the poisoned entry, calls readObject(), and the gadget chain executes in the JVM of the application server. This grants code execution with the privileges of the application process, which typically has database credentials and network access to internal services.

No verified public exploit code is available. The vulnerability is described in the GitHub Security Advisory GHSA-c5q4-97jw-jggh and the AWS Security Bulletin 2026-051.

Detection Methods for CVE-2026-14265

Indicators of Compromise

Unexpected child processes spawned by Java application servers running the AWS Advanced JDBC Wrapper, particularly shells, curl, wget, or scripting interpreters.
Outbound network connections from JDBC application JVMs to unusual hosts shortly after cache reads.
Redis or Valkey keys matching the plugin's cache key pattern containing serialized Java magic bytes (\\xac\\xed\\x00\\x05) written by clients other than the application tier.
Java stack traces referencing ObjectInputStream.readObject from RemoteQueryCachePlugin code paths in application logs.

Detection Strategies

Inspect Redis and Valkey access logs for SET or HSET operations originating from clients outside the expected application subnet.
Deploy runtime application self-protection or Java agent instrumentation to alert on readObject invocations that resolve to gadget classes such as InvokerTransformer or TemplatesImpl.
Correlate JDBC application process behavior with cache read events using endpoint telemetry to surface post-deserialization command execution.

Monitoring Recommendations

Log and centrally aggregate all Redis/Valkey authentication events and command activity with OCSF-normalized ingestion.
Monitor Java process lineage for JDBC-using services and alert on non-JVM child processes.
Track dependency inventories to identify hosts still running AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0.

How to Mitigate CVE-2026-14265

Immediate Actions Required

Upgrade the AWS Advanced JDBC Wrapper to version 4.0.1 or later on all application servers.
Audit Redis and Valkey instances used by the RemoteQueryCachePlugin for unauthorized writes and rotate any exposed credentials.
Restrict network access to cache infrastructure so that only trusted application tiers can write to it.
Enable authentication and TLS on Redis and Valkey endpoints if not already enforced.

Patch Information

Amazon Web Services released version 4.0.1 of the AWS Advanced JDBC Wrapper to remediate this issue. Details are available in the GitHub Release 4.0.1 notes and the AWS Security Bulletin 2026-051. Upgrade dependencies in Maven or Gradle build files and redeploy affected services.

Workarounds

Disable the RemoteQueryCachePlugin in the JDBC wrapper configuration until patching is complete.
Isolate the cache backend on a private network segment with strict allow-lists for write clients.
Deploy a global ObjectInputFilter via the jdk.serialFilter system property to block known gadget classes on JVMs that cannot be immediately upgraded.

bash

# Configuration example: disable the vulnerable plugin and set a serial filter
# Remove RemoteQueryCachePlugin from the wrapperPlugins property
jdbc:aws-wrapper:postgresql://db.example.internal:5432/app?wrapperPlugins=failover,efm

# Apply a JVM-wide deserialization filter as defense-in-depth
java -Djdk.serialFilter='!org.apache.commons.collections.functors.*;!org.apache.commons.collections4.functors.*;!org.codehaus.groovy.runtime.*;!com.sun.org.apache.xalan.internal.xsltc.trax.*;maxbytes=16384' -jar app.jar