AWS bulletin 2026-128: missing authorisation in Amazon Athena engine v3 let logged-in users read other AWS accounts' query metadata (CVE-2026-107352, CVSS 3.1 7.7); AWS fixed it on 1 Sep and says no customer data was accessed

AWS security bulletin 2026-128-AWS (published 7 October 2026, US Pacific time; early 8 October Perth) says missing authorisation checks in Amazon Athena engine version 3 request handling could have let an authenticated user read limited query metadata from other AWS accounts, namely AWS account identifiers and SQL statement text. AWS says query results, credentials and Amazon S3 data were not affected, that it fixed the issue on 1 September 2026, and that it has confirmed no customer metadata was accessed. No customer action is required. AWS credits Oren Yomtov of Act Security through coordinated disclosure. The AWS-issued CVE record rates it CVSS 3.1 7.7 (scope changed, high confidentiality impact). It is a cross-tenant flaw in a managed service, so there is nothing to patch on the customer side.

Product

Amazon Athena (engine version 3)

Versions

Amazon Athena engine version 3 before AWS's 1 Sep 2026 server-side fix (managed service; no customer versions)

CVSS

7.7 (CVSS 3.1, AWS CVE record)

Exploited in Australia?

unknown

Patch to

No customer action required; AWS fixed the service on 1 Sep 2026. Keep secrets and personal data out of SQL text where you can, since statement text was the exposed field.

Primary: AWS security bulletin 2026-128-AWS — CVE-2026-107352 Amazon Athena engine v3 missing authorisation (7 Oct 2026) · Vendor: AWS security bulletins · CVE: CVE-2026-107352 · CVE.org — CVE-2026-107352 (AWS CNA)

vulnerabilities cloud