AWS Fixes Athena Synapse Connector Flaw Allowing Data Leakage via Crafted Table Names
A vulnerability in the Athena Synapse connector could return unintended data when querying tables with specific names, according to an AWS advisory published on July 17, 2026.
Key points
- CVE-2026-12283 affects Athena Query Federation versions from v2022.20.1 through v2026.19.1.
- The flaw allows users with Azure Synapse access to create tables that leak data when queried.
- AWS released version v2026.21.1 to address the issue and advises patching forked code.
Amazon Web Services addressed a security flaw in its Athena Federated Query Synapse Connector on July 17, 2026. The company published bulletin 2026-059-AWS to detail CVE-2026-12283, which could allow unintended data exposure. The advisory classifies the issue as important and requires attention from administrators managing these connectors.
The vulnerability exists in the way the connector handles table names from Azure Synapse. According to AWS, a user with access to an Azure Synapse account can create a table with a specially crafted name. When this table is queried through the Athena Synapse connector, it may result in unintended data being returned to the requester.
Context and Background
Amazon Athena is a serverless, interactive query service that enables users to analyze data stored in Amazon S3 using standard SQL. Athena Query Federation extends this capability by allowing connections to data sources outside of S3, such as DynamoDB and Azure Synapse. These connectors are open source and are deployed to the Athena service on a regular basis to maintain compatibility and functionality.
The affected versions span a significant period, starting from v2022.20.1, released on May 19, 2022, up to v2026.19.1, released on May 28, 2026. AWS has addressed the issue in version v2026.21.1 of the Athena Query Federation. The vendor recommends upgrading to this latest version immediately.
Who Is Affected
Organizations using the Athena Synapse connector to query Azure Synapse databases are affected by this vulnerability. Specifically, any environment where the connector version falls between v2022.20.1 and v2026.19.1 is at risk. The threat model requires an attacker to have access to an Azure Synapse account, allowing them to create malicious table structures.
If your organization allows Synapse tables to be created programmatically, the risk is higher. AWS advises verifying that no tables exist that could be subject to SQL injection in the Synapse database. Administrators should also ensure that any forked or derivative code is patched to incorporate the new fixes provided in the latest release.
What should you do?
Administrators should check their current Athena Query Federation version against the affected range. Upgrading to v2026.21.1 or later is the primary mitigation step. Additionally, review Azure Synapse table creation processes to ensure input sanitization.
What to do and how to stay safe: AWS
- Verify the version of the Athena Query Federation connector currently deployed in your environment.
- Upgrade to version v2026.21.1 or later to apply the official fix for CVE-2026-12283.
- Audit Azure Synapse tables for any entries with unusual or specially crafted names.
- Sanitize input for any programs that create Synapse tables automatically to prevent future injection.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-12283?
It is a vulnerability in the Athena Synapse connector where crafted table names can cause unintended data to be returned during queries.
Which versions are affected?
Versions from v2022.20.1 through v2026.19.1 are affected by this security issue.
Is there a fix available?
Yes, AWS has addressed the issue in version v2026.21.1 and recommends upgrading to this version.
