---
id: "CVE-2026-107352"
kind: "vulnerability"
aliases: ["CVE-2026-107352"]
title: "Amazon Athena: missing authorization let users read other accounts' query metadata"
severity: "high"
cvss: 7.7
epss: 0.00201
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["athena", "aws", "lab-disclosure", "vendor"]
not_affected_if: ["service-side-fixed"]
published_at: "2026-10-07T21:17:15+00:00"
first_seen_at: "2026-10-24T18:56:54+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/", "first_seen_at": "2026-10-24T18:56:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107352", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107352", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Amazon Athena: missing authorization let users read other accounts' query metadata

Amazon Athena engine version 3 did not check authorization on some requests, so an authenticated user could read limited query metadata from other AWS accounts, namely account identifiers and SQL statement text. AWS fixed it service-side on September 1, 2026 and says no customer metadata was accessed, and query results, credentials and S3 data were not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- No customer action is required; AWS fixed the issue service-side on September 1, 2026.
- No workaround is available.

## Mitigated for you by

- AWS (platform-fix, since 2026-09-01): covers Amazon Athena engine version 3 request handling, remediated service-side for all customers Limits: none stated Still: No customer action is required https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/

## Timeline

- 2026-10-24T18:56:54+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/ — AWS: CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107352
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107352

## Documents

- [advisory] AWS: CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling https://aws.amazon.com/security/security-bulletins/rss/2026-128-aws/

## From the sources

CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling

### CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling

Bulletin ID: 2026-128-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/07/2026 13:00 PM PDT

Description:

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. Query results, credentials, and Amazon S3 data were not affected. No customer action is required.

Resolution:

This issue was addressed service-side on September 1, 2026.

Workarounds:

No workaround is available.

References:

- CVE-2026-107352

Acknowledgement:

We would like to thank Oren Yomtov of Act Security for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_