Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.
To remediate this issue, users should upgrade to version 4.3.0 or later.
To remediate this issue, users should upgrade to version 4.3.0 or later.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 11 Sep 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later. | |
| Title | Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin | |
| First Time appeared |
Aws
Aws aws Advanced Jdbc Wrapper |
|
| Weaknesses | CWE-611 | |
| CPEs | cpe:2.3:a:aws:aws_advanced_jdbc_wrapper:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Aws
Aws aws Advanced Jdbc Wrapper |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-09-11T16:34:46.764Z
Reserved: 2026-07-28T13:59:19.962Z
Link: CVE-2026-18061
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses