CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2
CVE-2026-89090
Summary
Bulletin ID: 2026-151-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/26/2026 09:30 AM PDT
Description:
The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users.
Exploiting the issue requires the ability to influence the CDK application's construct property values.
Impacted versions: <2.274.0-alpha.0
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.