AWS CDK Redshift Alpha Module Flaw Lets Crafted Names Alter Superuser SQL
Amazon Web Services has published a security bulletin for CVE-2026-115418, an SQL injection weakness in the database-query custom resource handlers of the @aws-cdk/aws-redshift-alpha module. The module is an experimental part of the AWS Cloud Development Kit that manages Amazon Redshift users, tables and privileges during deployment. All versions before 2.274.0-alpha.0 are affected, so any team using these alpha constructs to provision Redshift objects is in scope. The issue was reported through coordinated disclosure and the vendor classifies the bulletin, 2026-151-AWS, as Important. AWS has addressed it in @aws-cdk/aws-redshift-alpha version 2.274.0.
The weakness sits in how these constructs assemble the SQL that the custom resource handlers execute. Crafted user names, comments or passwords passed into the constructs can alter those statements, and they run against the cluster with Amazon Redshift superuser privileges at deployment time. The vendor states that the modified SQL could go as far as granting access to all cluster users. Exploitation depends on the attacker being able to influence the construct property values in the CDK application, so the values would need to come from a parameter or upstream source outside the developer's control rather than a fixed string.
Infrastructure-as-code pipelines are a valuable position for an attacker, because anything executed during deployment inherits the privileges of the deployment path, and here that is Redshift superuser. A successful injection could quietly widen table grants to PUBLIC, leaving a durable access route that outlives the pipeline run that created it. The prerequisite narrows the exposure considerably, since the property values must be reachable by someone other than the developer writing them, and the module carries experimental alpha status rather than general availability. FIRST EPSS places the probability of exploitation within the next 30 days at 0.2 percent.
Attack Surface
Cloud Service, Database, Supply Chain (Third-party vendors)
Tactics
Initial Access, Privilege Escalation, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
- T1195.002 – Compromise Software Supply Chain
- T1078.004 – Valid Accounts: Cloud Accounts
- T1565.001 – Data Manipulation: Stored Data Manipulation
SuperPRO's Threat Countermeasures Procedures
- Upgrade @aws-cdk/aws-redshift-alpha to version 2.274.0 or later, then rebuild and redeploy affected CDK applications; versions below 2.274.0-alpha.0 carry CVE-2026-115418 (GHSA-25hh-xvj4-2cqv).
- Review existing Amazon Redshift table grants to PUBLIC on clusters provisioned by these constructs and remove unintended ones with REVOKE ALL ON <table> FROM PUBLIC, as advised in AWS bulletin 2026-151-AWS.
- Supply only trusted, developer-authored literals for the user name, comment and password properties of the aws-redshift-alpha User, Table and privilege constructs; do not bind them to CloudFormation parameters, SSM values, pipeline variables or any externally supplied input.
- Locate and patch forked or derivative copies of the redshift-alpha constructs by searching repositories for imports of @aws-cdk/aws-redshift-alpha and applying the same 2.274.0 fixes to vendored code.
- Add a CI gate that fails the build when package.json or the lockfile resolves @aws-cdk/aws-redshift-alpha below 2.274.0, and pin the dependency rather than allowing floating alpha ranges.
- Inspect CloudWatch Logs for the Lambda-backed custom resource handlers used by these constructs and alert on deployment-time statements containing GRANT … TO PUBLIC or CREATE USER with unexpected names, which would indicate injected SQL running with Redshift superuser privileges.
