Amazon Athena
Monthly
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.