Loading story…
A critical SQL injection flaw tracked as CVE-2026-65321 affects PyAthena versions up to and including 3.35.3, allowing unauthenticated remote attackers to inject arbitrary SQL into Amazon Athena and Trino queries. The bug lies in DefaultParameterFormatter.format(), where DELETE and CTAS statements are passed to _escape_hive, which backslash-escapes single quotes even though Athena and Trino do not treat backslashes as valid string-literal escape characters. That mismatch lets attackers terminate string literals early and alter the intended query.
The vulnerability is rated CVSS 9.8 and can enable data exfiltration through UNION SELECT, execution of destructive SQL statements, and attacker-controlled CTAS destination paths and output content. The issue is classified as CWE-89 and has been fixed in PyAthena 3.35.4. Public reporting said no active exploitation had been confirmed at publication time, but defenders were urged to upgrade immediately and review logs for suspicious DELETE, CTAS, or UNION SELECT activity.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 2, 2026, a new CVE entry for CVE-2026-65321 was received, disclosing a critical SQL injection flaw in PyAthena affecting versions up to and including 3.35.3 / prior to 3.35.4. The issue stems from improper quote escaping in DefaultParameterFormatter.format() for DELETE and CTAS statements, enabling unauthenticated arbitrary SQL injection.
The vulnerability was fixed in PyAthena version 3.35.4, which is identified as the first non-vulnerable release. Sources state that versions prior to 3.35.4 are affected and recommend immediate upgrading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon disclosed two high-severity vulnerabilities in the **Amazon Athena ODBC driver** affecting versions before `2.1.0.0`, both tied to authentication flows involving external identity providers rather than direct connections to Athena itself. **CVE-2026-35560** is an improper certificate validation issue (`CWE-295`) in identity provider connection components that could let a man-in-the-middle attacker intercept authentication credentials because of insufficient default transport security. Amazon also reported **CVE-2026-35561**, an authentication control weakness (`CWE-862`) in the driver’s browser-based authentication components that could allow interception or hijacking of authentication sessions. Both flaws carry high confidentiality and integrity impact under CVSS scoring, and Amazon’s recommended remediation is to upgrade the Amazon Athena ODBC driver to version `2.1.0.0`, with updated release notes, security guidance, and platform-specific downloads published alongside the advisory.
Jun 29, 2026
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026
A critical SQL injection flaw tracked as **`CVE-2026-69240`** affects **Sequelize** when used with the **Oracle** database dialect, exposing applications that run versions prior to **`6.37.4`**. The vulnerability lies in the ORM's `sql-string.js` escape logic, which fails to properly escape quotes when a supplied string begins with Oracle function names such as **`TO_DATE`** or **`TO_TIMESTAMP`**, causing attacker-controlled input to be inserted directly into generated SQL queries. The issue is rated **CVSS 9.8** and can be exploited remotely without authentication, potentially allowing attackers to bypass application controls, read sensitive data, alter or delete records, and execute arbitrary SQL expressions. Reports warn that in Oracle deployments with elevated database privileges, the impact could extend beyond the database to filesystem access or operating system command execution, creating a path to full host compromise. The vendor has released a fix in **`Sequelize 6.37.4`** and advises affected users to upgrade immediately.
Aug 4, 2026