CVE-2026-115416

HighCVSS 7.7

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Summary

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results and data stored in Amazon S3 or other data sources were not accessible through this issue. AWS remediated the issue on October 7, 2026, and no customer action is required.

Risk Assessment

The flaw could have exposed AWS account identifiers and SQL query text across accounts, breaching tenant isolation. AWS has already remediated it, so current risk is negligible.

Recommendation

No action is required because AWS remediated the issue on October 7, 2026. It is sufficient to confirm you are using the current Athena engine version 3.

Other vulnerabilities in Amazon Athena

CVE-2026-107352High
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

Original NVD description (English source)

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS