Amazon Web Services has patched a SQL injection flaw in an experimental part of its cloud development toolkit, after finding that crafted values could alter database commands run during deployment. The issue, tracked as CVE-2026-115418, sits in the @aws-cdk/aws-redshift-alpha module, which helps developers manage Amazon Redshift users, tables and privileges. AWS published its security bulletin on 26 October 2026 and credited researcher Joseph Semaan for reporting the problem through coordinated disclosure.

What the flaw could allow

According to AWS, specially crafted user names, comments or passwords supplied to the affected constructs could change the SQL executed with Redshift superuser privileges at deployment time. In the worst case, that could include granting access to all users of a cluster. Exploitation is not automatic: an attacker would first need influence over the property values fed into the application. Even so, the combination of deployment-time privilege and attacker-controlled input is exactly the kind of weakness security teams treat as urgent.

Who should act now

Versions before 2.274.0-alpha.0 are affected, and AWS says the fix is included in version 2.274.0. Teams using the alpha module should upgrade promptly and check any forked or copied code for the same weakness, since copied code will not be fixed by updating the package alone. AWS also advises reviewing existing table grants to PUBLIC after upgrading, to catch any permissions that should never have been granted.

The case is a reminder that infrastructure code deserves the same scrutiny as application code. Values that look like harmless labels, such as a user name or a comment, can become part of a database command if they are not handled safely. Restricting those inputs to trusted, developer-written values, and auditing what deployment tools can do, reduces the chance that a small configuration choice turns into a serious database compromise.

Sources: AWS Security Bulletin 2026-151 and IT Security News summary.