Live › vulnerability › CVE-2026-107352
Go to dashboardAmazon Athena engine version 3 did not check authorization on some requests, so an authenticated user could read limited query metadata from other AWS accounts, namely account identifiers and SQL statement text. AWS fixed it service-side on September 1, 2026 and says no customer metadata was accessed, and query results, credentials and S3 data were not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Only AWS customers using Amazon Athena engine version 3 were in scope, and AWS says the fix is already applied service-side. The sources do not say whether any customer-side configuration changes exposure. Teams that use Athena can treat this as informational unless their own compliance process requires an audit of query-metadata exposure.
No product ranges from the sources yet.
Unknown from the sources.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling
Bulletin ID: 2026-128-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/07/2026 13:00 PM PDT
Description:
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. Query results, credentials, and Amazon S3 data were not affected. No customer action is required.
Resolution:
This issue was addressed service-side on September 1, 2026.
Workarounds:
No workaround is available.
References:
Acknowledgement:
We would like to thank Oren Yomtov of Act Security for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-107352")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.