CVE-2026-115416 Details
Description
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required.
A vulnerability exists in Amazon Athena engine version 3 query processing due to incorrect authorization checks. This issue could have permitted an authenticated user to access AWS account identifiers and SQL query metadata from other AWS accounts. However, it did not allow access to query results or data stored in Amazon S3 or other data sources. AWS has addressed this vulnerability on October 7, 2026, and no customer action is required.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-144-aws/ | AMZN | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-653 | Improper Isolation or Compartmentalization | AMZN |
| CWE-863 | Incorrect Authorization | AMZN |
Affected Products
| Product | Versions |
|---|---|
| Amazon Athena | 3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | AMZN |