CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
// AI summary
AWS Cloud Development Kit's @aws-cdk/aws-redshift-alpha module has a SQL injection flaw (CVE-2026-115418) in its database-query custom resource handlers, which manage Amazon Redshift users, tables and privileges.
// from the source
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, i