openGauss-connector-jdbc allows arbitrary class loading when it resolves a logger name from JDBC connection parameters. The driver calls Class.forName on the supplied logger class, then directly invokes a constructor that takes a String argument without verifying the class implements Log. An attacker who can control the JDBC URL or properties can supply a malicious class present on the client classpath, resulting in the driver loading and instantiating that class. This flaw corresponds to unsafe reflection (CWE-470) and can lead to execution of unintended code on the client. The vulnerability is rated with a CVSS score of 7, indicating moderate severity and the potential for remote code execution.

The flaw exists in openGauss-connector-jdbc starting with version 1.1.0 and continues through all 2.x, 3.x, 5.x, and 6.x series, including 6.0.6, as well as the 7.0.0-RC1 through 7.0.0-RC3 releases. It was fixed in the 7.0.0-LTS version. Any deployment of openGauss that uses a JDBC driver in this range and accepts externally controlled JDBC URLs or properties is potentially affected.

The exploitation path requires an attacker to supply a JDBC URL or set a connection property that specifies a malicious logger class name, and the class must be discoverable on the client’s classpath. When these conditions are met, the driver will instantiate the class, which can perform arbitrary actions such as code execution on the client, making the risk moderate to high. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Given the relatively high CVSS score, unpatched systems are at significant risk of remote code execution if exposed to untrusted JDBC input.