Vulnerability · Published Oct 7, 2026 · Assigned by AMZN

CVE-2026-107352Missing authorization checks in Amazon Athena engine version 3 request handling

High 7.7

In plain English

A high-severity missing authorization in Amazon Athena from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

Affected products (as reported)

Vendor	Product	Versions
AWS	Amazon Athena	N/A

Weakness: CWE-862, CWE-424 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://aws.amazon.com/security/security-bulletins/2026-128-aws/ vendor-advisory