CVE-2026-70410— Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
Quick assessment
Affected
Apache Software Foundation Apache Calcite Avatica
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Clas
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Calcite Avatica | < 1.29.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-70410
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
Source: CVE Program / CVE List V5
Vulnerability Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Class.forName(String) which by default triggers initialization. This may lead to the execution of static initializer blocks in arbitrary classes present in the classpath. The instantiation APIs should initialize and instantiate only classes implementing the specified plugin interface passed as input in conjunction with the desired classname. At the moment of writing, there are no well-known or widely used classes with dangerous static initializer blocks so the severity is low.
This issue affects Apache Calcite Avatica: before 1.29.0.
Users are recommended to upgrade to version 1.29.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Calcite Avatica | 0 ~ 1.29.0 | - |
|
II. Public POCs for CVE-2026-70410
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70410
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-70410 (1)
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A -
CVE-2026-91867
Apache Neethi: Remote policy fetch lacks a total timeout, al
Same weakness: CWE-470
-
CVE-2026-78030
DBI versions before 1.653 for Perl load arbitrary modules vi -
CVE-2026-93762
Data deletion and attribute disclosure via field-name method -
CVE-2026-93765
Document deletion and process crash via unvalidated method-n -
CVE-2026-10853
IBM MQ queue manager is vulnerable to remote code execution -
CVE-2026-66269
Dell OpenManage Server Admin 11.1.0.3前不安全反射漏洞
V. Comments for CVE-2026-70410
No comments yet