Key points
- AWS remediated the missing authorization checks in Athena engine version 3 on September 1, 2026.
- The flaw could have allowed authenticated users to read AWS account identifiers and SQL statement text from other accounts.
- AWS confirmed no customer metadata was accessed, and query results, credentials, and S3 data were not affected.
AWS has resolved a security vulnerability in Amazon Athena engine version 3 that involved missing authorization checks during request handling. The issue, tracked as CVE-2026-107352, was addressed service-side on September 1, 2026. According to the official AWS Security Bulletin published on October 7, 2026, the flaw could have permitted an authenticated user to read limited query metadata from other AWS accounts. This metadata included AWS account identifiers and the text of SQL statements.
By the numbers
- September 1, 2026: The date AWS remediated the issue service-side.
- October 7, 2026: The publication date of the security bulletin detailing the vulnerability.
- Zero: The number of customer metadata instances confirmed to have been accessed.
What the figures mean
The remediation date of September 1 indicates that the vulnerability existed for an undisclosed period prior to that fix. However, AWS has confirmed that no customer metadata was accessed during this window. The scope of the potential exposure was limited to query metadata, specifically account identifiers and SQL statement text. Crucially, the bulletin states that actual query results, credentials, and data stored in Amazon S3 were not affected by this missing authorization check. The issue required no customer action to resolve, as the fix was applied entirely by AWS on the service side.
What should you do?
Managed service providers and security teams should note that no immediate action is required from customers, as the fix has already been deployed. However, it is prudent to review access logs for Athena engine version 3 to ensure no anomalous activity occurred before September 1, 2026. While AWS confirmed no data was accessed, maintaining visibility into cross-account query patterns remains a best practice for detecting potential authorization bypass attempts. Teams should also ensure they are monitoring AWS Security Bulletins for similar service-side updates that may impact their environment.
Background: Authorization bypass vulnerabilities
Isolate affected systems immediately. Revoke all current sessions and tokens. Verify identity logic against the CISA Known Exploited Vulnerabilities catalog. Do not restart services until you confirm the authorization check is enforced. Audit logs for lateral movement. Reset credentials and deploy updated validation rules to prevent recurrence.
Read the full guide: Authorization Bypass Response: Containment and Recovery Steps
Frequently asked questions
Was customer data exposed in the Athena CVE-2026-107352 vulnerability?
No, AWS confirmed that no customer metadata was accessed, and query results, credentials, and S3 data were not affected.
Do customers need to update their Athena configurations to fix this issue?
No, the issue was addressed service-side by AWS on September 1, 2026, and no customer action is required.
What specific information could have been accessed via this vulnerability?
An authenticated user could have potentially read limited query metadata, including AWS account identifiers and SQL statement text, from other AWS accounts.
