Medium severity · published Apr 3, 2026
CVE-2026-35560
Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena.
To remediate this issue, users should upgrade to version 2.1.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Amazon Athena ODBC driver · Amazon
before 2.1.0.0 · source: vendor
AO
Athena Odbc · Amazon
before 2.1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35560
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-013-aws/
Release Notes
https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi
More from Amazon Athena ODBC driver
9.8
CVE-2026-35561
Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
7.8
CVE-2026-35558
Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
7.8
CVE-2026-5485
OS command injection in Amazon Athena ODBC driver on Linux
7.5
CVE-2026-35562
Allocation of resources without limits in parsing components in Amazon Athena ODBC driver
6.5
CVE-2026-35559
Out-of-bounds write in query processing components in Amazon Athena ODBC driver