CVE-2026-107352
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.
Risk Assessment
The organization may be exposed to disclosure of limited query metadata (account identifiers and SQL text) to other authenticated users, potentially compromising query information confidentiality.
Recommendation
No customer action is required as AWS has already remediated the issue. Monitor AWS communications to confirm the fix is active.
Other vulnerabilities in Amazon Athena
Original NVD description (English source)
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS