High severity · published Oct 22, 2026
CVE-2026-115416
Incorrect authorization checks in Amazon Athena engine version 3 query processing
New
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.
AWS remediated the issue on October 7, 2026. No customer action is required.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Amazon Athena · AWS
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115416
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-144-aws/
More from Amazon Athena
7.7
CVE-2026-107352
Missing authorization checks in Amazon Athena engine version 3 request handling
