Vulnerability · Published Apr 3, 2026 · Assigned by AMZN
CVE-2026-35558Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
High 7.8
In plain English
A high-severity command injection in Amazon Athena ODBC driver from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to execute arbitrary code or redirect authentication flows by using specially crafted connection parameters that are processed by the driver during user-initiated authentication. To remediate this issue, users should upgrade to version 2.1.0.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Amazon Athena ODBC driver | 0 – before 2.1.0.0 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://aws.amazon.com/security/security-bulletins/2026-013-aws/ vendor-advisory
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg patch
- https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg patch
- https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html release-notes