Advisoriesby IbisIncorrect authorization checks in Amazon Athena engine version 3 query processing
Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is an interactive query service that allows you to analyze data in Amazon S3 using standard SQL. We identified CVE-2026-115416, an issue in Amazon Athena engine version 3 query processing where incorrect authorization checks could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. Impacted versions: Amazon Athena engine version 3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Severity from
- NVD
More AWS advisories
All AWS
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in...CVE-2026-115417no fix yetUnintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerCVE-2026-115419no fix yetOS Command Injection Issue in SAM CLI Terraform HookCVE-2026-115414no fix yetCVE-2026-19642 & CVE-2026-19643CVE-2026-19642no fix yetCVE-2026-18656 & CVE-2026-18657CVE-2026-18656no fix yetIncorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB...CVE-2026-18954no fix yet