CVE-2026-14265: AWS Advanced JDBC Wrapper RemoteQueryCachePlugin Deserialization RCE

Technical summary

The RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper uses Java's ObjectInputStream to deserialize cached query results retrieved from Redis or Valkey without implementing class filtering or deserialization constraints. This unsafe deserialization of untrusted data (CWE-502) allows an attacker with write access to the cache infrastructure to craft a malicious serialized object containing gadget chains that execute arbitrary code when deserialized. The attack surface is limited to actors who can write to the shared cache system, but once successful, leads to remote code execution on backend application servers.

Business impact

Exploitation could result in full compromise of application servers that rely on the RemoteQueryCachePlugin for query result caching. An attacker could steal sensitive data, modify application behavior, establish persistent access, or disrupt service availability. Organizations using shared Redis/Valkey infrastructure across multiple applications face elevated risk, as cache poisoning in a multi-tenant environment could affect multiple services simultaneously.

Affected systems

AWS Advanced JDBC Wrapper versions 3.3.0, 3.4.x, and 4.0.0 are vulnerable. Applications using the RemoteQueryCachePlugin with Redis or Valkey as the cache backend are at risk. The vulnerability requires the attacker to have write access to the cache infrastructure, limiting exposure to internal threats, cache service misconfigurations, or compromised cache credentials.

Exploitability

Exploitation requires authentication and write access to the cache system (Redis or Valkey), placing this in the 'authenticated attacker' category. While the CVSS score reflects HIGH severity (7.5), real-world exploitation depends on cache access controls—well-isolated cache infrastructure significantly reduces risk. An attacker must also understand Java gadget chains and craft appropriate serialized objects, requiring moderate technical skill. The vulnerability is not currently known to be exploited in the wild.

Remediation

Upgrade AWS Advanced JDBC Wrapper to version 4.0.1 or later, which resolves the unsafe deserialization. Verify the upgrade is applied to all application servers using the RemoteQueryCachePlugin. As an interim mitigation, restrict network and credential-based access to your Redis/Valkey cache layer using firewall rules, authentication tokens, and encryption in transit. Monitor cache write activity for anomalous patterns.

Patch guidance

Apply AWS Advanced JDBC Wrapper version 4.0.1 or later. Consult your dependency management system (Maven, Gradle, etc.) to update the library version. Test the update in a development environment first, as JDBC wrapper upgrades may have compatibility implications with your application's database connectivity logic. AWS provides update guidance in their official security advisories.

Detection guidance

Monitor your Redis/Valkey cache for unusual serialized objects or write operations from unexpected sources. Implement cache integrity checks if your infrastructure supports them. Review application logs for errors during deserialization or unexpected class instantiation. Use Java deserialization filtering tools (e.g., NotSerialized filters) as defense-in-depth on application servers. Alert on any failed deserialization attempts or gadget chain signatures in network traffic to cache systems.

Why prioritize this

While the CVSS score is HIGH (7.5) and the impact is severe (RCE), the requirement for cache write access significantly limits the threat actor pool. Prioritize patching if your cache infrastructure is accessible from untrusted networks or shared across sensitive applications. If your Redis/Valkey instance is properly isolated and access-controlled, remediation can be scheduled within standard patch cycles, though upgrade to 4.0.1+ should not be deferred indefinitely.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects: (1) network-exploitable deserialization (AV:N), (2) high complexity due to the need for cache access and gadget chain knowledge (AC:H), (3) requirement for authenticated cache access (PR:L), (4) no user interaction needed (UI:N), and (5) high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately elevates the issue to HIGH due to RCE potential, though the authentication requirement prevents a CRITICAL rating.

Frequently asked questions