CVE-2026-70410: Apache Calcite Avatica RCE Vulnerability

CVE-2026-70410 Overview

CVE-2026-70410 is an unsafe reflection vulnerability [CWE-470] in Apache Calcite Avatica. The flaw resides in plugin instantiation logic, specifically AvaticaUtils#instantiatePlugin and related methods. These APIs pass externally controlled class names to Class.forName(String) without restriction, which triggers class initialization by default. An attacker who controls the class name argument can cause arbitrary classes on the classpath to load and execute their static initializer blocks. The Apache Calcite project fixed the issue in Avatica version 1.29.0 by restricting instantiation to classes that implement the specified plugin interface.

Critical Impact
Attackers with the ability to supply plugin class names can force loading and static initialization of arbitrary classpath classes, potentially leading to code execution when a dangerous static initializer is present.

Affected Products

Apache Calcite Avatica versions prior to 1.29.0
Applications embedding Avatica JDBC driver components
Downstream projects relying on Avatica plugin instantiation APIs

Discovery Timeline

2026-09-22 - CVE-2026-70410 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-70410

Vulnerability Analysis

Apache Calcite Avatica exposes helper methods for instantiating pluggable components at runtime. The AvaticaUtils#instantiatePlugin method accepts a class name string alongside an expected plugin interface. The intent is to load a class that implements the interface and return an instance.

The implementation calls Class.forName(String) with the caller-supplied class name. This overload uses the default initialization behavior, which runs the target class's static initializer block during resolution. Static initializers execute before any interface check occurs.

An attacker who influences the class name argument can therefore trigger arbitrary classpath class initialization. The Apache advisory notes that no widely deployed classes with dangerous static initializers are currently known, which limits practical exploitation today. The risk grows as new dependencies enter the classpath over the software's lifetime.

Root Cause

The root cause is unsafe reflection: externally controlled input flows directly into a class-selection primitive without validation. The Avatica code should have used the three-argument Class.forName(name, initialize, loader) form with initialize=false, or verified interface assignability before initialization. Instead, initialization occurred before any type check, breaking the intended plugin contract.

Attack Vector

Exploitation requires an authenticated attacker who can supply plugin class names through Avatica configuration surfaces, such as JDBC connection properties or server-side plugin parameters. The attacker submits a class name pointing to a target class present on the server's classpath. Avatica loads the class over the network without additional user interaction, and the JVM executes its static initializer. The attack vector is network-based with low complexity.

See the Apache Mailing List Thread for the vendor's technical description.

Detection Methods for CVE-2026-70410

Indicators of Compromise

Unexpected Class.forName invocations in Avatica process logs referencing non-plugin class names
JDBC connection strings or Avatica request payloads containing unusual factory, schemaFactory, or plugin class parameters
Runtime loading of classes outside the expected org.apache.calcite.* plugin namespace

Detection Strategies

Inventory Java applications and identify those bundling avatica-core or avatica-server artifacts below version 1.29.0
Instrument the JVM with a SecurityManager or Java agent to log reflective class loads triggered from Avatica code paths
Review Avatica server access logs for suspicious plugin class parameters in incoming requests

Monitoring Recommendations

Ingest Avatica server and JDBC gateway logs into a centralized analytics platform for anomaly review
Alert on JDBC connection attempts specifying unusual schemaFactory, driver, or plugin class values
Correlate outbound network activity from Avatica hosts with recent plugin instantiation events

How to Mitigate CVE-2026-70410

Immediate Actions Required

Upgrade Apache Calcite Avatica to version 1.29.0 or later across all affected deployments
Audit application configurations that expose plugin class names to untrusted input
Restrict Avatica server access to trusted networks and authenticated clients only

Patch Information

Apache Calcite released Avatica 1.29.0 with a fix that restricts plugin instantiation to classes implementing the requested interface. The corrected code path avoids triggering static initialization on unrelated classpath classes. Consult the Apache Mailing List Thread for release details and upgrade guidance.

Workarounds

Remove or disable Avatica endpoints that accept externally supplied plugin class names when upgrading is not immediately feasible
Enforce an allow-list of permitted plugin class names at the application boundary before passing values to Avatica
Minimize classpath contents to reduce the pool of classes an attacker could target for static initialization

bash

# Maven dependency upgrade example
<dependency>
    <groupId>org.apache.calcite.avatica</groupId>
    <artifactId>avatica-core</artifactId>
    <version>1.29.0</version>
</dependency>