CVE-2026-5485
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The Amazon Athena ODBC driver before version 2.0.5.1 on Linux contains an OS command injection vulnerability in the browser-based authentication component. An attacker can use specially crafted connection parameters loaded by the driver during a local user-initiated connection to execute arbitrary code.
Risk Assessment
The risk is remote code execution by an attacker who could gain access to data stored in Amazon Athena or other resources accessible to the user running the driver.
Recommendation
Upgrade the Amazon Athena ODBC driver to version 2.0.5.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Amazon Athena ODBC driver
See all- CVE-2026-35562High
The Amazon Athena ODBC driver before version 2.1.0.0 lacks resource limits during parsing. Crafted input can cause excessive resource consumption and denial of service (DoS).
- CVE-2026-35561High
Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows.
- CVE-2026-35560High
The Amazon Athena ODBC driver before version 2.1.0.0 improperly validates certificates when connecting to external identity providers, allowing a man-in-the-middle attacker to intercept credentials. This does not affect connections to Athena.
- CVE-2026-35559Medium
The Amazon Athena ODBC driver before version 2.1.0.0 contains an out-of-bounds write vulnerability in query processing components. Specially crafted data can crash the driver during query operations.
- CVE-2026-35558High
The Amazon Athena ODBC driver before version 2.1.0.0 improperly neutralizes special elements in authentication components. An attacker can use crafted connection parameters to execute arbitrary code or redirect authentication flows.
Original NVD description (English source)
OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection. To remediate this issue, users should upgrade to version 2.0.5.1 or later.