CVE-2024-49194
Databricks JDBC Driver Command Injection vulnerability
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
- Record
CVE-2024-49194- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2024-3598
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
- Record
EUVD-2024-3598- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jxw2-jvxf-5vrp
Databricks JDBC Driver Command Injection vulnerability
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
- Record
GHSA-jxw2-jvxf-5vrp- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
- Record
CVE-2024-49194- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-jxw2-jvxf-5vrp
Databricks JDBC Driver Command Injection vulnerability
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connection URL that uses the property krbJAASFile.
- Record
GHSA-jxw2-jvxf-5vrp- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.databricks:databricks-jdbcMaven |
2.0 up to 2.6.40 | 2.6.40 |
com.databricks:databricks-jdbcMaven |
2.0 up to 2.6.40, plus listed versions 2.6.252.6.25-12.6.25-alpha-12.6.25-alpha-22.6.25-beta-1 Show 12 moreShow less2.6.25-beta-22.6.25-beta-32.6.25-beta-42.6.272.6.27-beta-12.6.292.6.29-beta-12.6.322.6.332.6.342.6.362.6.38 |
2.6.40 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-49194 is a high vulnerability (CVSS 7.3) in com.databricks:databricks-jdbc, published December 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in com.databricks:databricks-jdbc 2.6.40.