CVE-2026-75910: Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon aws-athena-query-federation ClickHouse connectorto a version that resolves this vulnerability.Fixed in v2026.17.1 - Compensating control
If you use forked or derivative connector code, ensure it is patched to incorporate the v2026.17.1 fixes.
- Operational
Redeploy the connector using the current deployment template and supply a non-empty SecretNamePrefix value.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of the Amazon Athena Federated Query ClickHouse connector using a version prior to v2026.17.1 are affected. Forked or derivative connector code also needs the corresponding fixes applied.
What does an attacker need to exploit it?
The attacker must be an authenticated remote user. They need to point the connector at an unrelated AWS Secrets Manager secret and use a database endpoint under their control, which can receive the transmitted secret.
What should be done if an immediate version upgrade is not possible?
Redeploy the connector using the current deployment template and provide a non-empty SecretNamePrefix value. This is an alternative remediation to upgrading to v2026.17.1 or later.