Vulnerability · Published Apr 3, 2026 · Assigned by AMZN
CVE-2026-5485OS command injection in Amazon Athena ODBC driver on Linux
High 7.8
In plain English
A high-severity OS command injection in Amazon Athena ODBC driver from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection. To remediate this issue, users should upgrade to version 2.0.5.1 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Amazon Athena ODBC driver | 0 – before 2.0.5.1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://aws.amazon.com/security/security-bulletins/2026-013-aws/ vendor-advisory
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg patch
- https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html release-notes