CVE-2026-70410

Apache Calcite Avatica (before 1.29.0 ) is affected by an unsafe reflection vulnerability in plugin instantiation. Methods such as AvaticaUtils#instantiatePlugin call Class.forName(String) without restricting initialization, which triggers execution of static initializer blocks in any arbitrary c...