In plain language
What this advisory means
A security problem was found in the AWS Advanced JDBC Wrapper, which helps applications connect to certain Amazon databases. This problem happens when a specific optional feature called RemoteQueryCachePlugin is turned on with a shared cache. A bad actor who can write to that shared cache might add harmful XML code. Later, when the application reads this cached data, it could reveal sensitive files and database credentials to the attacker. AWS fixed this issue in version 4.3.0 and advises users to upgrade or disable that optional feature if they cannot update immediately.
Technical explanation
How the issue affects the environment
CVE-2026-18061 is an improper restriction of XML External Entity (XXE) processing in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When the plugin is enabled with a shared cache, an attacker with write permissions to the cache can insert crafted XML into a cached column value. Upon reading this cached XML, the wrapper's XML parser resolves external entities, potentially exposing sensitive files accessible to the application process, such as stored database credentials and IAM role information. This vulnerability affects versions 3.3.0 and above and is remediated in version 4.3.0 by restricting XXE resolution. Disabling the plugin or limiting write permissions to the shared cache can mitigate risk.
Operational impact
Why teams should care
If exploited, this vulnerability could allow attackers to read sensitive files and credentials from the environment where the AWS Advanced JDBC Wrapper is running. This can lead to unauthorized access to databases and AWS resources, risking data confidentiality and trust. Organizations using affected versions with the vulnerable plugin enabled must promptly address this to prevent potential data breaches.
Immediate action
Upgrade the AWS Advanced JDBC Wrapper to version 4.3.0 or later, which includes the fix for improper XXE handling in the RemoteQueryCachePlugin. Ensure that any forked or derivative codebases are also patched accordingly.
Affected and fixed releases
Temporary risk reduction
Disable the RemoteQueryCachePlugin if it is not required, as it is not enabled by default. Alternatively, restrict write access to the shared cache so that only trusted users or systems can write to it, mitigating the risk of injecting malicious XML.
Evidence and validation checklist
- AWS Security Bulletin ID 2026-109-AWS
- AWS advisory publication date 09/11/2026
- Description of CVE-2026-18061 on AWS site
- Recommendation to upgrade to version 4.3.0
- Workaround details about disabling RemoteQueryCachePlugin and restricting cache write access
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.