RHLW-2026-2ed8124d625db0c0: Lightwell Security Advisory: pyathena 3.34.0+rhlw.1

Q: Which deployments should prioritize remediation?

Deployments using pyathena 3.34.0 should prioritize remediation, particularly where application-controlled or otherwise untrusted values can reach SQL execution paths involving DELETE or CTAS statements. The issue is rated critical with network-reachable, low-complexity, unauthenticated exploitation characteristics.

Q: What fixed package is available?

Red Hat Lightwell released pyathena 3.34.0+rhlw.1 with a backported fix for CVE-2026-65321. It is described as a drop-in replacement for pyathena 3.34.0 from PyPI.

Q: How can I determine whether an environment is affected?

Check the installed pyathena package version. Environments running pyathena 3.34.0 are the stated replacement target; pyathena 3.34.0+rhlw.1 is the patched Lightwell artifact.

Published Nov 10, 2026

Updated

Red Hat Lightwell has released pyathena 3.34.0+rhlw.1 with a backported security fix.

CVE-2026-65321: PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

This patched artifact is a drop-in replacement for pyathena 3.34.0 from PyPI.

Affected Software

1 affected componentFixes available

red-hat-lightwell/pyathena<3.34.0+rhlw.1

3.34.0+rhlw.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/pyathena to a version that resolves this vulnerability.
Fixed in 3.34.0+rhlw.1
Upgrade
Upgrade pyathena to a version that resolves this vulnerability.
Fixed in 3.34.0+rhlw.1

Event History

Nov 10, 2026

Advisory Published

via OSV·03:37 PM

Data Sourced

via OSV·03:37 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments should prioritize remediation?

Deployments using pyathena 3.34.0 should prioritize remediation, particularly where application-controlled or otherwise untrusted values can reach SQL execution paths involving DELETE or CTAS statements. The issue is rated critical with network-reachable, low-complexity, unauthenticated exploitation characteristics.

What fixed package is available?

Red Hat Lightwell released pyathena 3.34.0+rhlw.1 with a backported fix for CVE-2026-65321. It is described as a drop-in replacement for pyathena 3.34.0 from PyPI.

How can I determine whether an environment is affected?

Check the installed pyathena package version. Environments running pyathena 3.34.0 are the stated replacement target; pyathena 3.34.0+rhlw.1 is the patched Lightwell artifact.

RHLW-2026-2ed8124d625db0c0: Lightwell Security Advisory: pyathena 3.34.0+rhlw.1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should prioritize remediation?

What fixed package is available?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should prioritize remediation?

What fixed package is available?

How can I determine whether an environment is affected?