CVE-2026-111440: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection') in openGauss-server openGauss-connector-jdbc

The vulnerability exists in openGauss-connector-jdbc's LogFactory component, which uses Class.forName to load a logger class specified via JDBC connection parameters. It then directly invokes a constructor with a String argument without verifying that the loaded class is a subclass of Log. This lack of asSubclass(Log.class) validation allows an attacker controlling the JDBC URL or connection properties to cause the client to load and instantiate arbitrary classes present in the classpath, potentially triggering unintended side effects. The vulnerability was introduced in JDBC version 1.1.0 and affects multiple subsequent versions across 2.x, 3.x, 5.x, and 6.x branches, including release candidates of 7.0.0. The fix, implemented in 7.0.0-LTS, adds a subclass check after class loading to restrict instantiation to Log subclasses only.

An attacker who can control the JDBC connection parameters, specifically the logger class name, and has the ability to influence the client classpath, may cause the client to load and instantiate arbitrary classes. This can lead to unexpected behavior or side effects on the client system. The vulnerability has a CVSS score of 7.0 (high severity) with impact on confidentiality, integrity, and availability. However, exploitation requires local access to the client environment or control over the client classpath and connection parameters.

A fix is available in openGauss-connector-jdbc version 7.0.0-LTS, which adds a subclass verification step after Class.forName to ensure only subclasses of Log are instantiated. Users should upgrade to version 7.0.0-LTS or later to remediate this vulnerability. Until upgrading, avoid using untrusted input in JDBC connection parameters, especially the logger class name, and restrict client classpath contents to trusted classes only.