{"id":"CVE-2026-107352","kind":"vulnerability","aliases":["CVE-2026-107352"],"related":[],"title":"Amazon Athena: missing authorization let users read other accounts' query metadata","description":"CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling\n\n### CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling\n\nBulletin ID: 2026-128-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/07/2026 13:00 PM PDT\n\nDescription:\n\nMissing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. Query results, credentials, and Amazon S3 data were not affected. No customer action is required.\n\nResolution:\n\nThis issue was addressed service-side on September 1, 2026.\n\nWorkarounds:\n\nNo workaround is available.\n\nReferences:\n\n- CVE-2026-107352\n\nAcknowledgement:\n\nWe would like to thank Oren Yomtov of Act Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Amazon Athena engine version 3 did not check authorization on some requests, so an authenticated user could read limited query metadata from other AWS accounts, namely account identifiers and SQL statement text. AWS fixed it service-side on September 1, 2026 and says no customer metadata was accessed, and query results, credentials and S3 data were not affected.","severity":"high","cvss":7.7,"epss":0.00201,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["athena","aws","lab-disclosure","vendor"],"not_affected_if":["service-side-fixed"],"how_to_check":null,"fix":"- No customer action is required; AWS fixed the issue service-side on September 1, 2026.\n- No workaround is available.","status":"open","published_at":"2026-10-07T21:17:15+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T03:14:12+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:14:12Z","model":"claude-haiku-5-5","output":{"fix":"- No customer action is required; AWS fixed the issue service-side on September 1, 2026.\n- No workaround is available.","reach":"internet","title":"Amazon Athena: missing authorization let users read other accounts' query metadata","impact":"medium","summary":"Amazon Athena engine version 3 did not check authorization on some requests, so an authenticated user could read limited query metadata from other AWS accounts, namely account identifiers and SQL statement text. AWS fixed it service-side on September 1, 2026 and says no customer metadata was accessed, and query results, credentials and S3 data were not affected.","category":"vendor","nicknames":[],"who_cares":["aws","athena"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other accounts' SQL text and account identifiers readable by an authenticated user","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["service-side-fixed"],"who_is_affected":"Only AWS customers using Amazon Athena engine version 3 were in scope, and AWS says the fix is already applied service-side. The sources do not say whether any customer-side configuration changes exposure. Teams that use Athena can treat this as informational unless their own compliance process requires an audit of query-metadata exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":3712,"output_tokens":480,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107352':14A,17A,85C,99C,215C '-128':114C '-2026':13A,16A,84C,98C,214C '00':127C '1':64B,170C,205C '10/07/2026':125C '13':126C '2026':65B,113C,171C,206C '3':28B,94C,108C,139C 'access':72B,179C 'account':9A,48B,50B,154C,163C 'acknowledg':216C 'act':225C 'action':192C 'address':199C 'affect':82B,189C 'allow':144C 'amazon':1A,24B,90C,104C,135C,184C 'athena':2A,18B,25B,91C,105C,136C 'attent':122C 'authent':38B,146C 'author':4A,32B,87C,101C,132C 'avail':211C 'aw':19B,47B,56B,115C,117C,153C,162C,164C 'aws-security@amazon.com':240C 'bulletin':111C 'check':31B,88C,102C,133C 'collabor':228C 'concern':246C 'confirm':174C 'content':118C 'coordin':234C 'could':40B,142C 'credenti':76B,182C 'custom':69B,176C,191C 'cve':12A,15A,83C,97C,213C 'data':79B,186C 'date':124C 'descript':130C 'disclosur':22B,236C 'email':239C 'engin':26B,92C,106C,137C 'fix':57B 'handl':96C,110C,141C 'id':112C 'identifi':51B,155C 'import':120C 'issu':167C,197C,231C 'lab':21B 'lab-disclosur':20B 'let':5A 'like':219C 'limit':42B,150C 'metadata':11A,44B,70B,152C,177C 'miss':3A,86C,100C,131C 'name':49B 'oren':222C 'pdt':129C 'pleas':238C 'pm':128C 'process':237C 'public':123C 'queri':10A,43B,74B,151C,180C 'question':244C 'read':7A,41B,149C 'refer':212C 'remedi':165C 'request':35B,95C,109C,140C 'requir':121C,194C 'resolut':195C 'result':75B,181C 's3':78B,185C 'say':67B 'scope':116C 'secur':226C,243C 'septemb':63B,169C,204C 'servic':60B,201C 'service-sid':59B,200C 'side':61B,202C 'sql':53B,157C 'statement':54B,158C 'text':55B,159C 'thank':221C 'type':119C 'user':6A,39B,147C 'vendor':23B 'version':27B,93C,107C,138C 'vulner':235C 'workaround':207C,209C 'would':218C 'yomtov':223C","nicknames":[],"mitigations":[{"kind":"platform-fix","scope":null,"since":"2026-09-01","covers":"Amazon Athena engine version 3 request handling, remediated service-side for all customers","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/","vendor":"AWS","seen_at":"2026-10-25T08:27:06Z","confidence":0.9,"source_title":"CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling","customer_action":"No customer action is required"}],"who_affected":"Only AWS customers using Amazon Athena engine version 3 were in scope, and AWS says the fix is already applied service-side. The sources do not say whether any customer-side configuration changes exposure. Teams that use Athena can treat this as informational unless their own compliance process requires an audit of query-metadata exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/#CVE-2026-107352","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-25T08:29:54+00:00","note":"AWS: CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling"},{"source":"nvd","external_id":"CVE-2026-107352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107352","severity":null,"published_at":"2026-10-07T21:17:15+00:00","modified_at":"2026-10-11T21:16:42+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107352","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107352","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2910,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/","title":"AWS: CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling","kind":"advisory","source":"lab","text":"CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling\n\n### CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling\n\nBulletin ID: 2026-128-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/07/2026 13:00 PM PDT\n\nDescription:\n\nMissing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. Query results, credentials, and Amazon S3 data were not affected. No customer action is required.\n\nResolution:\n\nThis issue was addressed service-side on September 1, 2026.\n\nWorkarounds:\n\nNo workaround is available.\n\nReferences:\n\n- CVE-2026-107352\n\nAcknowledgement:\n\nWe would like to thank Oren Yomtov of Act Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}