CVE-2026-46718
published 2026-06-02CVE-2026-46718: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcite: from…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.44%
35.1th percentile
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | calcite | >= 1.5.0 < 1.42.0 | 1.42.0 |
| apache_software_foundation | apache_calcite | >= 1.5.0 < 1.42 | 1.42 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
ghsa_unreviewed·2026-06-02
CVE-2026-46718 [MEDIUM] CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
GHSA
Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
ghsa·2026-06-02
CVE-2026-46718 [MEDIUM] CWE-470 Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
VulDB
Apache Calcite up to 1.41 privilege escalation
vuldb·2026-06-01
CVE-2026-46718 [LOW] Apache Calcite up to 1.41 privilege escalation
A vulnerability was found in Apache Calcite up to 1.41. It has been declared as problematic. The affected element is an unknown function. The manipulation results in privilege escalation.
This vulnerability was named CVE-2026-46718. The attack needs to be approached within the local network. There is no available exploit.
It is recommended to upgrade the affected component.
Red Hat
calcite: org.apache.calcite.avatica/avatica-core: Apache Calcite: Unsafe Reflection vulnerability allows externally-controlled input to select classes or code.
vendor_redhat·2026-06-02·CVSS 6.5
CVE-2026-46718 [MEDIUM] CWE-470 calcite: org.apache.calcite.avatica/avatica-core: Apache Calcite: Unsafe Reflection vulnerability allows externally-controlled input to select classes or code.
calcite: org.apache.calcite.avatica/avatica-core: Apache Calcite: Unsafe Reflection vulnerability allows externally-controlled input to select classes or code.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
A flaw was found in Apache Calcite when processing specially crafted queries. An authenticated user could trigger unintended application behavior through affected query-processing functionality. Exploitation requires access to the vulnerable feature and is limited to the application's operating context. The issue does not allow direct takeover of the host or unrestricted execution of arb
No detection rules found.
No public exploits indexed.
2026-06-02
Published