CVE-2026-46718

[CVE catalog]

Severity

Medium · CVSS 6.5

Published

Jun 2, 2026, 9:17:51 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.44% · Oct 25, 2026

A flaw was found in Apache Calcite when processing specially crafted queries. An authenticated user could trigger unintended application behavior through affected query-processing functionality. Exploitation requires access to the vulnerable feature and is limited to the application's operating context. The issue does not allow direct takeover of the host or unrestricted execution of arbitrary code. calcite: org.apache.calcite.avatica/avatica-core: Apache Calcite: Unsafe Reflection vulnerability allows externally-controlled input to select classes or code. This Moderate flaw in Apache Calcite allows an authenticated attacker to trigger unintended application behavior by submitting specially crafted queries. While exploitation is limited to the application's operating context and does not permit direct host takeover or arbitrary code execution, it could lead to unexpected application states. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.