CVE-2026-115416High· 7.7▾ TwilightIncorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.
AWS remediated the issue on October 7, 2026. No customer action is required.
amazon_athena N/ARefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119115High· 8.5Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
CVE-2026-107352High· 7.7Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts
CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2026-108263Critical· 9.9Astron Agent is an agentic workflow platform for building and running AI agents
CVE-2026-118029Medium· 5.9Unverified ownership of the default Athena query result location in AWS SDK for pandas
CVE-2026-115413High· 7.8AWS API MCP Server OAuth Token Audience Validation Bypass