Amazon Athena EUVD-2026-108258

Exploitation required an already-authenticated AWS principal (PR:L) with access to issue queries through Amazon Athena engine version 3; no user interaction and no special non-default configuration are indicated in the source. The impact was strictly limited to reading cross-account AWS account identifiers and SQL statement text query metadata - query results and data in Amazon S3 or other data sources were never accessible through this issue, which substantially caps the value of exploitation. The single most important limiting factor is temporal: AWS remediated the flaw service-side on October 7, 2026, so it is no longer exploitable and no customer action is required.

This is a low-to-moderate priority issue that the vuln.today framework correctly labels 'monitor', and the surrounding signals reinforce that. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring an authenticated AWS principal (PR:L) with no user interaction, but every vulnerable-system impact is scored N (VC:N/VI:N/VA:N); the only impact is SC:H, i.e. confidentiality of a subsequent system (other AWS accounts). That SC:H rating sits in tension with the description, which limits exposure to AWS account identifiers and SQL statement text metadata and explicitly excludes query results and underlying S3/other data - a limited, metadata-only disclosure rather than a full confidentiality breach, so the H rating is arguably generous. There is no CISA KEV listing, no EPSS probability supplied, and no public exploit or PoC reference in the input, so exploitation likelihood signals are absent rather than alarming. Most decisively, AWS states it remediated the issue service-side on October 7, 2026 with no customer action required, meaning the window for exploitation is closed for all customers; this is a disclosed-and-already-fixed cloud-service issue rather than an open operational risk.

An attacker who already holds valid credentials in some AWS account issues queries through Amazon Athena engine version 3, and due to an incorrect authorization check is able to read account identifiers and the SQL statement text of query metadata belonging to other, unrelated AWS accounts. No public exploit or PoC is identified in the available data, and because actual query results and the underlying S3/other-source data remained inaccessible, the payoff is limited to cross-tenant metadata reconnaissance. The specific request or query construct that triggered the authorization gap is not described in the available sources.