CVE-2026-18061 Overview
CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the RemoteQueryCachePlugin component of the AWS Advanced JDBC Wrapper. The flaw affects versions 3.3.0 through 4.2.0 and stems from improper restriction of XML external entity references [CWE-611]. An actor with write access to the shared cache infrastructure can craft malicious XML data in a cached column value. Application hosts that later read those cached query results parse the entity and disclose sensitive local files. Exposed data can include stored database credentials and IAM role credentials used by the application.
Critical Impact
Attackers with write access to the shared cache can exfiltrate database and IAM credentials from any application host that reads poisoned cache entries.
Affected Products
- Amazon AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0
- Applications using the RemoteQueryCachePlugin with a shared cache backend
- Java services that consume cached query results produced by the wrapper
Discovery Timeline
- 2026-09-11 - CVE-2026-18061 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-18061
Vulnerability Analysis
The AWS Advanced JDBC Wrapper provides plugins that extend JDBC connections with additional behavior. The RemoteQueryCachePlugin stores query result data in a shared cache so multiple application hosts can reuse results. When column values are serialized as XML and retrieved from that cache, the underlying XML parser processes external entity declarations without restriction. An attacker who can write to the shared cache injects XML containing external entities that reference local files on the consuming host. When a downstream application reads the cached row, the parser resolves the entity and returns file contents in place of the column value. This is a classic server-side XXE pattern amplified by the trust boundary between cache producers and cache consumers.
Root Cause
The root cause is an XML parser configuration that fails to disable external entity resolution and DTD processing. Secure XML parsing in Java requires explicit hardening of DocumentBuilderFactory, SAXParserFactory, or XMLInputFactory instances. The vulnerable plugin does not apply these controls before deserializing cached XML data, allowing entity expansion against the local filesystem.
Attack Vector
Exploitation requires write access to the shared cache infrastructure used by the RemoteQueryCachePlugin. The attacker inserts a crafted cache entry whose column value contains an XML payload declaring an external entity such as file:/// references to credential files. A legitimate application host reads the cached row through the wrapper, triggers XML parsing, and returns the resolved entity content to the caller or logs. Sensitive files that may be exfiltrated include database connection secrets, AWS IAM role credentials, and configuration files readable by the Java process.
No verified public proof-of-concept is available. See the GitHub Security Advisory GHSA-fpvp-qwgm-v6h9 for technical details.
Detection Methods for CVE-2026-18061
Indicators of Compromise
- Cache entries containing XML tokens such as <!DOCTYPE, <!ENTITY, or SYSTEM "file:// in column values
- Unexpected read access by the JDBC application process to files like /etc/passwd, ~/.aws/credentials, or application configuration paths
- Anomalous outbound network requests from application hosts to attacker-controlled hosts referenced by external entities
- JDBC wrapper logs showing XML parsing errors on cached rows
Detection Strategies
- Inspect the shared cache backend for stored values that begin with XML declarations or contain DOCTYPE definitions
- Enable audit logging on IAM roles used by application hosts and alert on credential use from unexpected source IPs
- Correlate JDBC wrapper version telemetry with process file-access events on Linux hosts
- Review application logs for XML parsing exceptions originating from RemoteQueryCachePlugin
Monitoring Recommendations
- Monitor egress traffic from Java application hosts for connections to non-approved destinations that could indicate out-of-band XXE exfiltration
- Track write operations to the shared cache backend and enforce least privilege on cache write permissions
- Alert on credential rotation anomalies and unexpected sts:AssumeRole calls tied to application IAM roles
How to Mitigate CVE-2026-18061
Immediate Actions Required
- Upgrade the AWS Advanced JDBC Wrapper to version 4.3.0 or later on all application hosts
- Rotate database credentials and IAM role credentials that were accessible to applications running vulnerable versions
- Audit shared cache contents and purge any entries containing XML external entity declarations
- Restrict write access to the shared cache backend to trusted producers only
Patch Information
Amazon released the fix in version 4.3.0 of the AWS Advanced JDBC Wrapper. Refer to the GitHub Release v4.3.0 and the AWS Security Bulletin 2026-109 for release notes and remediation guidance.
Workarounds
- Disable the RemoteQueryCachePlugin in the wrapper configuration until the upgrade is complete
- Segment the shared cache infrastructure so only vetted services can write to it
- Apply strict network egress controls on application hosts to block outbound entity resolution
# Configuration example: upgrade dependency in Maven pom.xml
# <dependency>
# <groupId>software.amazon.jdbc</groupId>
# <artifactId>aws-advanced-jdbc-wrapper</artifactId>
# <version>4.3.0</version>
# </dependency>
mvn versions:set-property -Dproperty=aws.jdbc.wrapper.version -DnewVersion=4.3.0
mvn clean install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
