AWS fixes missing auth checks in Athena engine version 3 request handling
Amazon Web Services patched a flaw allowing authenticated users to view limited query metadata from other accounts. No customer data was accessed.
Key points
- AWS remediated CVE-2026-107352 service-side on September 1, 2026.
- The flaw allowed reading limited query metadata, including SQL text and account IDs.
- Query results, credentials, and S3 data were not affected by the vulnerability.
Amazon Web Services has resolved a security vulnerability in Amazon Athena engine version 3 that permitted authenticated users to access limited query metadata from other AWS accounts. The company issued an official security bulletin, identified as 2026-128-AWS, on October 7, 2026, to detail the issue and confirm that the remediation was completed service-side on September 1, 2026.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-107352
The vulnerability, tracked as CVE-2026-107352, stemmed from missing authorization checks within the request handling process of the Athena engine version 3. According to the AWS advisory, this gap could have allowed an authenticated user to read specific metadata associated with queries run in other AWS accounts. The accessible information was strictly limited to AWS account identifiers and the text of the SQL statements. AWS has confirmed that no customer metadata was accessed through this vulnerability prior to the fix.
Scope and Impact
The security bulletin categorizes the content type as "Important," indicating that it requires attention from security professionals. However, the potential impact was contained to metadata exposure rather than sensitive data leakage. AWS explicitly stated that query results, customer credentials, and data stored in Amazon S3 were not affected by the missing authorization checks. The scope of the issue was isolated to the Amazon Athena service within the AWS cloud infrastructure.
The remediation was handled entirely by AWS on the service side. This means the fix was applied to the underlying infrastructure managing the Athena engine version 3, rather than requiring updates to client-side software or user configurations. The company confirmed that the issue was addressed on September 1, 2026, which is nearly a month before the public advisory was published on October 7, 2026.
Who is affected
The vulnerability affected users of Amazon Athena engine version 3. Any authenticated user within the AWS ecosystem could potentially have exploited the missing authorization checks to view the limited metadata described above. Because the fix was applied service-side, all customers using the affected version of the Athena engine were automatically protected once the remediation went live on September 1, 2026.
AWS has confirmed that there is no evidence of exploitation or unauthorized access to customer metadata. The company’s statement that no customer metadata was accessed suggests that while the vulnerability existed, it did not result in a confirmed data breach or privacy incident for any specific customer.
What should you do?
No customer action is required to address this vulnerability. AWS resolved the issue service-side, meaning the patch was applied to the cloud infrastructure automatically. Customers do not need to update software, change configurations, or rotate credentials in response to this bulletin. The advisory directs users to the AWS Security Bulletin page for the most up-to-date and complete information related to this security event.
What to do and how to stay safe: AWS
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107352?
It is a vulnerability in Amazon Athena engine version 3 caused by missing authorization checks in request handling.
Did this flaw allow attackers to steal data?
No, AWS confirmed that no customer metadata was accessed and that query results and credentials were not affected.
Do I need to update my Athena version?
No, the issue was remediated service-side by AWS on September 1, 2026, so no customer action is required.
