Loading story…
Amazon disclosed two high-severity vulnerabilities in the Amazon Athena ODBC driver affecting versions before 2.1.0.0, both tied to authentication flows involving external identity providers rather than direct connections to Athena itself. CVE-2026-35560 is an improper certificate validation issue (CWE-295) in identity provider connection components that could let a man-in-the-middle attacker intercept authentication credentials because of insufficient default transport security.
Amazon also reported CVE-2026-35561, an authentication control weakness (CWE-862) in the driver’s browser-based authentication components that could allow interception or hijacking of authentication sessions. Both flaws carry high confidentiality and integrity impact under CVSS scoring, and Amazon’s recommended remediation is to upgrade the Amazon Athena ODBC driver to version 2.1.0.0, with updated release notes, security guidance, and platform-specific downloads published alongside the advisory.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
New CVE entries disclosed two high-severity vulnerabilities in the Amazon Athena ODBC driver: CVE-2026-35560, which could enable man-in-the-middle interception of credentials in external identity provider integrations, and CVE-2026-35561, which could allow interception or hijacking of browser-based authentication sessions. The issues do not affect direct connections to Athena itself and impact driver versions before 2.1.0.0.
AWS identified Amazon Athena ODBC driver version 2.1.0.0 as the remediation for two security issues affecting versions before 2.1.0.0: improper certificate validation in identity provider connections and insufficient authentication security controls in browser-based authentication components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical SQL injection flaw tracked as **`CVE-2026-65321`** affects **PyAthena** versions up to and including **3.35.3**, allowing unauthenticated remote attackers to inject arbitrary SQL into Amazon Athena and Trino queries. The bug lies in `DefaultParameterFormatter.format()`, where `DELETE` and `CTAS` statements are passed to `_escape_hive`, which backslash-escapes single quotes even though Athena and Trino do not treat backslashes as valid string-literal escape characters. That mismatch lets attackers terminate string literals early and alter the intended query. The vulnerability is rated **CVSS 9.8** and can enable **data exfiltration** through `UNION SELECT`, execution of destructive SQL statements, and attacker-controlled `CTAS` destination paths and output content. The issue is classified as **CWE-89** and has been fixed in **PyAthena 3.35.4**. Public reporting said no active exploitation had been confirmed at publication time, but defenders were urged to upgrade immediately and review logs for suspicious `DELETE`, `CTAS`, or `UNION SELECT` activity.
Aug 3, 2026
AWS disclosed two severe vulnerabilities in **AWS Ops Wheel** that can let attackers seize administrative control of deployments and manipulate tenant data. **`CVE-2026-6911`** is an authentication bypass caused by missing JWT signature verification at the API Gateway endpoint, allowing unauthenticated attackers to forge tokens and gain unintended admin access. AWS said successful exploitation could let attackers read, modify, and delete application data across tenants and manage Cognito user accounts in the deployment's User Pool; the flaw is tracked as **`CWE-347`** and carries a critical **CVSS v3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`** rating. AWS also fixed **`CVE-2026-6912`**, a privilege-escalation issue in Ops Wheel's Cognito User Pool configuration that let authenticated users promote themselves to deployment administrator by setting the **`custom:deployment_admin`** attribute through the `UpdateUserAttributes` API. The bug, classified as **`CWE-915`**, exposed the same ability to manage Cognito user accounts and carried a high-severity **CVSS v3.1 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`** score. AWS directed customers to redeploy from the updated repository and apply the fixes to any forked or derivative code, with patches referenced in an AWS security bulletin, a GitHub pull request, and a GitHub security advisory.
Jun 29, 2026
AWS published a series of security bulletins covering vulnerabilities across several products and SDKs, including **model artifact integrity verification issues** in the Amazon SageMaker Python SDK (`CVE-2026-8596`, `CVE-2026-8597`), a **heap out-of-bounds read** in `coreMQTT` MQTT5 property parsing (`CVE-2026-8686`), and a **remote code execution** flaw in the `amazon-redshift-python-driver` (`CVE-2026-8838`). The company also disclosed an **arbitrary file read** issue in the `rabbitmq-aws` plugin (`CVE-2026-9133`), **tool execution without authorization via piped stdin** in Kiro CLI (`CVE-2026-9255`), and **insecure deserialization** in Amazon Braket SDK job results processing (`CVE-2026-9291`). A separate advisory addressed **improper authentication token handling** in the Amazon WorkSpaces client for Linux. Taken together, the disclosures span cloud development tools, messaging components, data platforms, quantum-computing SDKs, and end-user clients, indicating a broad patching requirement for organizations using AWS software. Security teams should identify affected packages and clients in their environments and prioritize remediation for flaws that could enable **remote code execution, unauthorized actions, file disclosure, or unsafe processing of untrusted data**.
Jul 12, 2026