CVE-2024-12746: SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-24 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0.

Affected products

Amazon Redshift ODBC Driver: 2.1.5.0

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-015/
https://github.com/aws/amazon-redshift-odbc-driver/releases/tag/v2.1.6
https://github.com/aws/amazon-redshift-odbc-driver/security/advisories/GHSA-g63m-5vjv-wr3v

Get alerted when CVE-2024-12746 or the next vulnerability affects your stack