CVE-2026-107352— Missing authorization checks in Amazon Athena engine version 3 request handling
Quick assessment
Affected
AWS Amazon Athena
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Amazon Athena 引擎版本 3 的请求处理中，缺少授权检查，可能导致已认证用户读取其他 AWS 账户的有限查询元数据（包括 AWS 账户标识符和 SQL 语句文本）。查询结果、凭据以及 Amazon S3 数据不受影响。AWS 已于 2026 年 9 月 1 日修复了该问题，并确认没有访问任何客户元数据。无需客户采取任何操作。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107352
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing authorization checks in Amazon Athena engine version 3 request handling
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | Amazon Athena | N/A | - |
|
II. Public POCs for CVE-2026-107352
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107352
请登录查看更多情报信息。
Other References for CVE-2026-107352 (1)
-
https://aws.amazon.com/security/security-bulletins/2026-128-aws/ vendor-advisory
IV. Related Vulnerabilities
Same vendor: AWS
-
CVE-2026-106032
Server-side request forgery and local file read via unrestri -
CVE-2026-105812
Code injection via unencoded configuration values during Pyt -
CVE-2026-105811
Authorization bypass through a user-controlled key in the Am -
CVE-2026-104019
OS command injection in the Studio Space startup validation -
CVE-2026-103958
Server-side request forgery in the tool server and remote ag
Same weakness: CWE-862
-
CVE-2026-76272
Missing Access Control through the REST API in Splunk Secure -
CVE-2026-96335
WordPress Forminator plugin <= 1.57.2 - Broken Access Contro -
CVE-2026-20328
Cisco Smart Software Manager On-Prem Arbitrary Account Passw -
CVE-2026-62179
PraisonAI: Platform members can delete owner issue dependenc -
CVE-2026-27434
WordPress WP Rentals theme <= 3.14.2 - Broken Access Control
V. Comments for CVE-2026-107352
No comments yet