SB2026092477 - Unsafe reflection in Apache Calcite Avatica

Description

This security bulletin contains information about 1 vulnerability.

1) Unsafe reflection (CVE-ID: CVE-2026-70410)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger the execution of static initializer blocks in arbitrary classes present on the classpath.

The vulnerability exists due to use of externally controlled input to select classes or code in plugin instantiation APIs, including AvaticaUtils#instantiatePlugin, when instantiating plugins from a supplied class name. A local user can supply an arbitrary class name to trigger the execution of static initializer blocks in arbitrary classes present on the classpath.

No well-known or widely used classes with dangerous static initializer blocks were known at the time of the advisory.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=4692gzgpwjgh7vrnnmhhj0qq3bos3v3m
• https://issues.apache.org/jira/browse/CALCITE-7610