CVE-2026-107352
Description
A flaw was found in Amazon Athena. Missing authorization checks during request handling can lead to information disclosure across different accounts. An authenticated user could exploit this flaw to access query metadata belonging to other accounts, exposing account identifiers and Structured Query Language (SQL) query statements.
Statement
Red Hat rates this vulnerability as Important because authenticated remote actors could breach multi-tenant security boundaries to expose sensitive SQL statements and cloud tenant identifiers across account environments. This vulnerability is restricted to the server-side infrastructure of the AWS-managed Amazon Athena query service. Red Hat offerings do not package, deploy, or manage Amazon Athena, meaning Red Hat products are not directly affected.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
