Authorization Vulnerability in Amazon Athena Engine Version 3
CVE-2026-115416

6.3MEDIUM

Key Information:

Vendor

Aws

Status
Amazon Athena
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115416?

An improper authorization check in Amazon Athena engine version 3 has been identified, which could enable authenticated users to access AWS account identifiers and SQL statement text query metadata belonging to other AWS accounts. While this vulnerability does not compromise the security of query results or stored data in Amazon S3 or other data repositories, it could lead to unintended exposure of sensitive metadata. Amazon has addressed this issue as of October 7, 2026, ensuring users do not need to take further action.

Affected Version(s)

Amazon Athena

References

https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.