Aws Athena Query Federation
Monthly
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.