AWS CDK Redshift Module Vulnerability Exposes Superuser Privileges via SQL Injection

A SQL injection vulnerability, identified as CVE-2026-115418, has been found in the `database-query` custom resource handlers within the AWS CDK's `@aws-cdk/aws-redshift-alpha` module. This vulnerability, present in versions prior to 2.274.0-alpha.0, allows an attacker to inject and execute arbitrary SQL statements with Amazon Redshift superuser privileges. The attack vector involves influencing construct property values, such as crafted usernames, comments, or passwords, which are then used in database queries. This vulnerability is significant because it grants attackers the highest level of privilege within an Amazon Redshift cluster. With superuser access, an attacker can potentially access, modify, or delete any data, as well as grant broad access to other cluster users. This directly impacts data confidentiality, integrity, and availability. Any organization utilizing AWS CDK to provision and manage Amazon Redshift clusters is affected, especially those with applications that dynamically generate or accept user-provided input for Redshift construct properties. The ease with which this can be exploited, by simply manipulating input fields, makes it a high-priority concern. This incident highlights a recurring theme in cloud security: the critical importance of secure coding practices and input validation, even within infrastructure-as-code frameworks. While CDK aims to abstract away underlying complexities, vulnerabilities can still emerge from how services are integrated and how user-supplied data is handled. This echoes past incidents where misconfigurations or insecure patterns in IaC led to significant security exposures. The broader trend emphasizes that security must be integrated throughout the development lifecycle, from initial code to deployment, including the tools used to define infrastructure. In practice, practitioners should immediately upgrade their `@aws-cdk/aws-redshift-alpha` module to version 2.274.0-alpha.0 or newer. Following the upgrade, it is crucial to review all existing table grants to `PUBLIC` within their Redshift clusters to ensure no unintended access has been granted due to this vulnerability. Furthermore, development teams should reinforce secure coding principles, particularly around input sanitization and validation for any data that flows into infrastructure definitions. Implementing static application security testing (SAST) tools that can analyze IaC for such patterns would also be a beneficial proactive measure. Organizations should also consider the principle of least privilege when defining Redshift users and their permissions, even for administrative accounts, to limit the blast radius of any potential compromise.