CVE-2026-46718: Apache Calcite Unsafe Reflection Vulnerability – CVSS 6.5

Technical summary

CVE-2026-46718 is an unsafe reflection vulnerability (CWE-470) in Apache Calcite that stems from the application's use of externally-controlled input to select and instantiate Java classes without proper validation. An attacker can craft specific input that, when processed by Calcite's reflection mechanism, causes the application to load arbitrary classes from the classpath or remote sources. The attack surface is broad because it requires no special privileges or user interaction—any network caller can trigger the vulnerable code path. The CVSS 3.1 score of 6.5 (Medium) reflects the ability to achieve both confidentiality and integrity impacts without service disruption.

Business impact

Organizations running vulnerable Calcite instances risk unauthorized data access and potential code execution depending on the classpath and deployed environment. In scenarios where Calcite is embedded in data query services, analytics platforms, or ETL pipelines, a successful exploit could expose customer data, corrupt query results, or enable lateral movement within the infrastructure. The lack of authentication requirement significantly increases business risk in internet-facing deployments.

Affected systems

The vulnerability affects Apache Calcite versions 1.5.0 through 1.41. Any application or service that embeds or depends on these versions of Calcite is at risk. This includes SQL engines, analytical frameworks, and any application utilizing Calcite's query planning and execution layers. Organizations should inventory dependencies to identify all affected instances, including transitive dependencies in their build chains.

Exploitability

This vulnerability is exploitable without authentication, user interaction, or special network configuration. An attacker with network connectivity to an application using vulnerable Calcite can send crafted input to trigger unsafe reflection. The attack complexity is low, meaning reliable exploitation does not require sophisticated techniques or race conditions. However, the vulnerability is not yet tracked in CISA's KEV catalog, suggesting it may not yet be actively exploited in the wild or may have limited public proof-of-concept availability.

Remediation

Upgrade Apache Calcite to version 1.42 or later, which addresses the unsafe reflection flaw. Organizations should prioritize this upgrade for any systems directly or transitively dependent on vulnerable Calcite versions. For applications unable to upgrade immediately, network segmentation and access controls should restrict exposure of Calcite-dependent services to trusted networks only.

Patch guidance

Apply Apache Calcite version 1.42 or newer. Before upgrading, test the patch in a staging environment to ensure compatibility with your specific use of Calcite APIs and SQL dialects. Verify the upgrade in your build system if Calcite is a transitive dependency; update version constraints in your dependency management configuration (Maven POM, Gradle build.gradle, etc.). After patching, restart all affected services and validate that application functionality remains intact.

Detection guidance

Monitor application logs and network traffic for unusual class loading patterns or reflection-based operations originating from external sources. Network detection should focus on traffic to Calcite-dependent services that includes suspicious serialized Java objects or JDBC payloads. Implement application-level monitoring for ClassNotFoundException or SecurityException events that may indicate attempted exploitation. Vulnerability scanners should flag any declared dependency on Calcite versions prior to 1.42 during software composition analysis.

Why prioritize this

Although the CVSS score is Medium (6.5), the lack of authentication and user interaction requirements, combined with the broad attack surface in data platforms, warrants prompt patching. The vulnerability does not currently appear in active exploitation campaigns (not on KEV list), but the ease of weaponization and potential for data exfiltration justify treating this as a high-priority patch in environments where Calcite handles sensitive queries or data.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity due to achievable confidentiality and integrity impacts over the network with low attack complexity. The score does not account for the absence of authentication as a mitigating factor in internal deployment scenarios, but in internet-facing or multi-tenant environments, the actual risk may be higher. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) confirms network attack vector, no privileges required, no user interaction, and impact limited to the vulnerable component only (not availability).

Frequently asked questions