CVE-2026-107352CWE-424CWE-862broken-access-control

CVE-2026-107352

High · published October 8, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00201 · 9.4th percentile
Weaknesses
CWE-424 · Improper Protection of Alternate Path; CWE-862 · Missing Authorization
Published
2026-10-08T01:17Z
References (1)
https://aws.amazon.com/security/security-bulletins/2026-128-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 20:14Z
    Missing authorization checks in Amazon Athena engine version 3 request handling
    cvelistv5
  • 07 OCT 20:14Z
    Missing authorization checks in Amazon Athena engine version 3 request handling
    cvelistv5