Unsafe reflection in Apache Calcite Avatica - CVE-2026-70410
Published: September 24, 2026
Vulnerability identifier: #VU151961
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70410
CWE-ID: CWE-470
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger the execution of static initializer blocks in arbitrary classes present on the classpath.
The vulnerability exists due to use of externally controlled input to select classes or code in plugin instantiation APIs, including AvaticaUtils#instantiatePlugin, when instantiating plugins from a supplied class name. A local user can supply an arbitrary class name to trigger the execution of static initializer blocks in arbitrary classes present on the classpath.
No well-known or widely used classes with dangerous static initializer blocks were known at the time of the advisory.
Affected software
Apache Calcite Avatica
How to mitigate CVE-2026-70410
Install security update from vendor's website.
Apache Calcite Avatica - update to 1.29.0