Use of unsafe reflection allows an attacker to trigger the static initializer of any class present in the application’s classpath. If that initializer performs privileged operations, the attacker could gain unauthorized privileges, modify data, or disrupt service. The vulnerability is classified as CWE‑470. While no widely deployed classes with dangerous static initializers are known, the potential remains if malicious or vulnerable classes are introduced.

The issue is in Apache Calcite Avatica versions before 1.29.0. Systems running any affected release of Avatica may call AvaticaUtils.instantiatePlugin or similar APIs and automatically load a class identified by a supplied name.

The EPSS score is unavailable and the vulnerability is not in CISA’s KEV catalog, indicating no publicly reported exploitation yet. The attack would likely require control over the plugin name passed to the instantiation API or access to the application’s classpath. Because the trigger is internal to the library, the risk of remote exploitation is low unless an attacker can influence the plugin configuration. Nonetheless, the presence of unrestricted class initialization makes it an actionable security concern.