EUVD-2026-63585Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable by low-privilege authenticated users; scope changes because impact crosses into Secrets Manager resources outside the connector's authorization boundary.
Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).
CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value.
AnalysisAI
Secret exfiltration from AWS Secrets Manager is enabled by incorrect privilege assignment in the ClickHouse connector deployment template for Amazon Athena Federated Query prior to v2026.17.1. An authenticated AWS user who can deploy or reconfigure the connector can craft a malicious connection string targeting any arbitrary Secrets Manager secret in the account and route it through a database endpoint under their control, causing the connector Lambda to fetch and transmit the secret value to that attacker-controlled host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The ClickHouse connector for Amazon Athena Federated Query must be deployed in the AWS account using the vulnerable template (versions prior to v2026.17.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) accurately characterizes this threat: low-complexity, network-accessible exploitation requiring only low-privilege authenticated AWS access, with high confidentiality impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege AWS IAM identity with CloudFormation deployment permissions crafts connector parameters specifying a target Secrets Manager secret ARN belonging to an unrelated production service and sets the connection endpoint to an attacker-controlled server mimicking a ClickHouse instance. When the connector Lambda is invoked by an Athena query, it fetches the specified secret from Secrets Manager and transmits its value as connection credentials to the attacker's server, where it is logged. … |
| Remediation | The primary remediation is upgrading to aws-athena-query-federation connectors version v2026.17.1 or later, available at https://github.com/awslabs/aws-athena-query-federation/releases/tag/v2026.17.1; organizations maintaining forked or derivative connector code must separately patch those forks to incorporate the new template fixes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and restrict IAM policies limiting ClickHouse connector deployment and reconfiguration permissions to essential administrators only; disable the connector if not actively required for production workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allShare
External POC / Exploit Code
Leaving vuln.today