CVE-2026-46718¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
A use of externally-controlled input to select classes or code ("unsafe reflection") vulnerability in Apache Calcite affects versions from 1.5.0 before 1.42.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
WSO2 Identity Server bundles Apache Solr for registry content indexing and search. Solr depends transitively on Apache Calcite, and the WSO2 Solr orbit bundle does embed calcite-core, calcite-linq4j and avatica-core on its bundle classpath.2 However, the Solr feature that drives Calcite is not shipped.
The Parallel SQL module is absent. In Solr 9.x, Parallel SQL moved out of solr-core into an optional sql module, and that module is not part of the bundle: it contains no org/apache/solr/handler/sql/ package and no SQLHandler class, so the /sql request handler cannot be registered. Only the client-side JDBC shim ships, and it forwards to a remote /sql endpoint rather than invoking Calcite locally.
Nothing in the product uses Calcite. No code in the shipped distribution references org/apache/calcite outside the Calcite JARs themselves, and no bundle exports org.apache.calcite.
Because the vulnerable component is embedded but unreachable, the unsafe-reflection code path cannot be triggered in the product.
In WSO2 Identity Server 7.3.0 the library is not present at all. That release ships a newer WSO2 Solr orbit bundle whose build declares no calcite-core, calcite-linq4j or avatica-core dependency and embeds none of them. No Calcite class exists anywhere in the distribution in standalone, nested, shaded or relocated form, so the affected library is absent rather than merely unreachable.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. As a hardening measure, the Calcite distribution embedded in the Solr bundle of the affected releases will be updated to a fixed version in a future release.