diff --git a/core/src/main/java/org/apache/calcite/avatica/Meta.java b/core/src/main/java/org/apache/calcite/avatica/Meta.java
index a4f45c6bc..83de22822 100644
--- a/core/src/main/java/org/apache/calcite/avatica/Meta.java
+++ b/core/src/main/java/org/apache/calcite/avatica/Meta.java
@@ -722,7 +722,10 @@ public static CursorFactory fromProto(Common.CursorFactory proto) {
 
       if (proto.hasField(CLASS_NAME_DESCRIPTOR)) {
         try {
-          clz = Class.forName(proto.getClassName());
+          // Resolve without initializing: a server parsing this from an untrusted
+          // client must not run the named class's static initializer.
+          clz = Class.forName(proto.getClassName(), false,
+              CursorFactory.class.getClassLoader());
         } catch (ClassNotFoundException e) {
           throw new RuntimeException(e);
         }