A critical vulnerability in Apache Calcite Avatica allows authenticated attackers to potentially execute arbitrary code via unsafe class instantiation.

This flaw involves the use of unsafe reflection in the AvaticaUtils component, where externally controlled input is used to call Class.forName without sufficient validation. This enables a low privileged authenticated attacker to trigger static initializer blocks in arbitrary classes present on the classpath.

Successful exploitation of this vulnerability could lead to complete system compromise, including unauthorized data access, integrity violations, and potential service disruption. While the vendor notes that currently known classes with dangerous static initializers are not widely used, the CVSS score of 8.8 reflects the high potential for impact if a suitable gadget class is discovered or introduced into the environment.

Immediate Action: Update Apache Calcite Avatica to version 1.29.0 or later to ensure proper interface-based validation during plugin instantiation.

Proactive Monitoring: Review application logs for unusual instantiation errors or suspicious class loading patterns that deviate from standard operational behavior.

Compensating Controls: Restrict network access to the affected service to trusted users only, as the vulnerability requires a low level of privilege to initiate the exploit.

Public Exploit Available: No

Given the high CVSS score, organizations should prioritize upgrading their Apache Calcite Avatica deployments to version 1.29.0. While active exploitation is not currently observed, the potential for remote code execution via unsafe reflection necessitates immediate patching to reduce the attack surface.