CVE-2026-115416: Incorrect authorization checks in Amazon Athena engine version 3 query processing
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.
AWS remediated the issue on October 7, 2026. No customer action is required.
Affected Software
Event History
Frequently Asked Questions
What information could an affected user access?
An authenticated user could have read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results and data stored in Amazon S3 or other data sources were not accessible through this issue.
What level of access was required to exploit this issue?
Exploitation required an authenticated user. The issue affected authorization checks in Amazon Athena engine version 3 query processing.
Is customer remediation required?
No. AWS remediated the issue on October 7, 2026, and stated that no customer action is required.