CVE-2026-35560criticalCWE-295

CVE-2026-35560: falha crítica em Amazon Athena ODBC driver

Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Amazon Athena ODBC driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.3%
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Amazon · Amazon Athena ODBC driver
CVEs relacionadas — Amazon Athena ODBC driver

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5485HIGHOS command injection in Amazon Athena ODBC driver on LinuxEPSS 0.9%CVE-2026-35561CRITICALInsufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driverEPSS 0.5%CVE-2026-35562HIGHAllocation of resources without limits in parsing components in Amazon Athena ODBC driverEPSS 0.4%CVE-2026-35559HIGHOut-of-bounds write in query processing components in Amazon Athena ODBC driverEPSS 0.3%CVE-2026-35558HIGHImproper neutralization of special elements in authentication components in Amazon Athena ODBC driverEPSS 0.3%