Is there a patch available for CVE-2026-12283?

Yes, a patch is available for CVE-2026-12283. Update the affected software to the latest version immediately.

Athena Query Federation CVE-2026-12283

Q: What is the CVSS score of CVE-2026-12283?

CVE-2026-12283 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45271 MEDIUM

SQL Injection (CWE-89)

2026-07-17 AMZN

SQLi AWS Microsoft Aws Athena Query Federation

6.1

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

High privileges required to invoke the Synapse connector; scope changes to downstream Azure Synapse; read-only injection means no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:50 vuln.today

CVE Published

Jul 17, 2026 - 19:05 cve.org

MEDIUM 6.1

DescriptionCVE.org

Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax.

Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name.

To remediate this issue, users should upgrade to version v2026.21.1 or later.

AnalysisAI

SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) describes a failure to sanitize user-controlled input before it is incorporated into a SQL statement. In this case, the Athena Query Federation framework - identified by CPE cpe:2.3:a:aws:aws-athena-query-federation:*:*:*:*:*:*:*:* - exposes connectors that translate federated SQL queries into native queries against external data sources. The Synapse connector bridges Amazon Athena and Azure Synapse Analytics, passing table name parameters into SQL constructs without adequate escaping or parameterization. Because Athena Federation is serverless and connector-based, the injection point lives in the connector's query-building logic rather than in a traditional application server, making it a supply-chain-style risk for organizations relying on the open-source federation library from awslabs.

RemediationAI

Upgrade aws-athena-query-federation to version v2026.21.1 or later, which contains the vendor-released patch per the GitHub release at https://github.com/awslabs/aws-athena-query-federation/releases/tag/v2026.21.1. The AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-059-aws/ should be consulted for deployment-specific guidance. If an immediate upgrade is not feasible, organizations can restrict access to the Synapse connector by limiting IAM permissions so that only trusted, named identities can invoke federation queries against the Synapse data source - this reduces the pool of potential attackers but does not remediate the underlying injection flaw. A second compensating control is to audit and restrict which Athena workgroups have access to the Synapse data source catalog, minimizing blast radius. Both mitigations carry the trade-off of operational disruption for teams relying on Synapse federation for analytics workflows.