CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the AWS Advanced JDBC Wrapper's optional RemoteQueryCachePlugin. This plugin, when enabled with a shared cache, allows an actor with write access to insert crafted XML into cached column values. When the application reads these cached results as XML, external entities are resolved, potentially disclosing sensitive files accessible by the application process, including database and IAM role credentials. The vulnerability affects versions from 3.3.0 up to and including 4.2.0. It has been fixed in version 4.3.0. The plugin is not enabled by default, and mitigation includes disabling the plugin or restricting write access to the shared cache.
AI Analysis
Technical Summary
The AWS Advanced JDBC Wrapper enhances JDBC drivers with AWS-specific features and includes an optional RemoteQueryCachePlugin for automated SQL query caching. CVE-2026-18061 is an XXE vulnerability due to improper restriction of XML external entity references in this plugin. An attacker with write access to the shared cache can insert malicious XML payloads into cached data. When the application parses this cached XML, external entities are resolved, which can lead to disclosure of sensitive files readable by the application process, such as stored database credentials and IAM role credentials. The vulnerability affects versions >=3.3.0 and <=4.2.0 and is resolved in version 4.3.0. The plugin is disabled by default. Mitigation includes upgrading to 4.3.0 or disabling the plugin and restricting write access to the cache.
Potential Impact
An attacker with write access to the shared cache infrastructure can exploit this vulnerability to cause the application to disclose sensitive files accessible to its process, including database and IAM role credentials. This could lead to unauthorized access to sensitive AWS resources and data.
Mitigation Recommendations
This vulnerability is fixed in AWS Advanced JDBC Wrapper version 4.3.0. Users are advised to upgrade to this version or later. For those unable to upgrade immediately, mitigation includes not enabling the RemoteQueryCachePlugin (which is disabled by default) or restricting write access to the shared cache so that only trusted principals can write to it.
CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
Description
CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the AWS Advanced JDBC Wrapper's optional RemoteQueryCachePlugin. This plugin, when enabled with a shared cache, allows an actor with write access to insert crafted XML into cached column values. When the application reads these cached results as XML, external entities are resolved, potentially disclosing sensitive files accessible by the application process, including database and IAM role credentials. The vulnerability affects versions from 3.3.0 up to and including 4.2.0. It has been fixed in version 4.3.0. The plugin is not enabled by default, and mitigation includes disabling the plugin or restricting write access to the shared cache.
Affected software
pkg:maven/com.amazonaws/advanced-jdbc-wrapperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AWS Advanced JDBC Wrapper enhances JDBC drivers with AWS-specific features and includes an optional RemoteQueryCachePlugin for automated SQL query caching. CVE-2026-18061 is an XXE vulnerability due to improper restriction of XML external entity references in this plugin. An attacker with write access to the shared cache can insert malicious XML payloads into cached data. When the application parses this cached XML, external entities are resolved, which can lead to disclosure of sensitive files readable by the application process, such as stored database credentials and IAM role credentials. The vulnerability affects versions >=3.3.0 and <=4.2.0 and is resolved in version 4.3.0. The plugin is disabled by default. Mitigation includes upgrading to 4.3.0 or disabling the plugin and restricting write access to the cache.
Potential Impact
An attacker with write access to the shared cache infrastructure can exploit this vulnerability to cause the application to disclose sensitive files accessible to its process, including database and IAM role credentials. This could lead to unauthorized access to sensitive AWS resources and data.
Mitigation Recommendations
This vulnerability is fixed in AWS Advanced JDBC Wrapper version 4.3.0. Users are advised to upgrade to this version or later. For those unable to upgrade immediately, mitigation includes not enabling the RemoteQueryCachePlugin (which is disabled by default) or restricting write access to the shared cache so that only trusted principals can write to it.
Technical Details
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-109-aws/","fetched":true,"fetchedAt":"2026-09-11T16:44:15.009Z","wordCount":243}
Threat ID: 6aa42fdf91cc7f384868feb9
Added to database: 09/11/2026, 16:44:15 UTC
Last enriched: 09/11/2026, 16:44:24 UTC
Last updated: 09/11/2026, 16:51:45 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.