CVE-2026-46718: Apache Calcite Vulnerable to Unsafe Reflection via Externally-Controlled Input
Summary
CVE-2026-46718: Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes. Affects org.apache.calcite:calcite-core versions >= 1.5.0, < 1.42.0. Fixed in 1.42.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Calcite is a dynamic data management framework that provides advanced SQL parsing, optimization, and execution capabilities. It is widely used in various applications to enable complex data processing and analytics. However, versions prior to 1.42 are susceptible to a vulnerability that allows external input to dictate class selection, potentially leading to unauthorized code execution.
Vulnerability Detail
The vulnerability arises from the use of externally-controlled input to select classes or code, known as 'Unsafe Reflection'. This flaw can be exploited by attackers to manipulate the input and execute arbitrary code within the application, leading to severe security risks such as data breaches or system compromise. The affected versions of Apache Calcite range from 1.5.0 up to, but not including, 1.42.
How To Fix
Minimum fixed version
1.42.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to sanitize and restrict the types of inputs that can be processed by the application. This can help mitigate the risk of exploitation until a proper upgrade can be performed.
Conclusion
Apache Calcite versions prior to 1.42 are vulnerable to unsafe reflection, allowing external input to dictate class selection. Users are strongly advised to upgrade to version 1.42 or later to secure their applications against potential exploitation. Implementing input validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for org.apache.calcite:calcite-core →
FAQ
CVE-2026-46718 is a vulnerability in Apache Calcite that allows external input to dictate class selection, leading to potential code execution.
The vulnerability affects Apache Calcite versions from 1.5.0 up to, but not including, 1.42.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
If an immediate upgrade is not feasible, implement input validation to mitigate risks until you can update to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.calcite:calcite-core.
