Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-
    python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on
    the client. To remediate this issue, users should upgrade to version 2.1.14. (CVE-2026-8838)

ID	Name	Product	Family	Type	Severity
465148	Echo: redshift-connector: security update to 2.1.14	Tenable Cloud Security	Echo Local Security Checks	Local	critical
465148	Echo: redshift-connector: security update to 2.1.14	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
442484	SCA: security update for redshift-connector (GHSA-29h4-r29x-hchv)	Tenable Cloud Security	SCA Checks	Local	critical
442484	SCA: security update for redshift-connector (GHSA-29h4-r29x-hchv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-8838

critical

Tenable Plugins

critical

critical

critical

critical