CVE-2026-35560
Full vulnerability record from the local CVENow database.
Description
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.
Severity
CRITICAL
CVSS score
9.1
(v4.0)
Vulnerability status
Modified
Source identifier
ff89ba41-3aa1-4d27-914a-91399e9639e5
Published
2026-04-03 21:17:12.073000
Last modified
2026-10-20 19:17:36.127000
View original CVE JSON
{
"id": "CVE-2026-35560",
"sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"published": "2026-04-03T21:17:12.073",
"lastModified": "2026-10-20T19:17:36.127",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena.\n\n\n\nTo remediate this issue, users should upgrade to version 2.1.0.0."
},
{
"lang": "es",
"value": "La validación de certificado indebida en los componentes de conexión del proveedor de identidad en el controlador ODBC de Amazon Athena anterior a la versión 2.1.0.0 podría permitir que un actor de amenaza man-in-the-middle intercepte las credenciales de autenticación debido a una seguridad de transporte predeterminada insuficiente al conectarse a proveedores de identidad. Esto solo se aplica a conexiones con proveedores de identidad externos y no se aplica a conexiones con Athena.\n\nPara remediar este problema, los usuarios deberían actualizar a la versión 2.1.0.0."
}
],
"affected": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"affectedData": [
{
"vendor": "Amazon",
"product": "Amazon Athena ODBC driver",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.1.0.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-07T03:55:37.348990Z",
"id": "CVE-2026-35560",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:amazon:athena_odbc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.0.0",
"matchCriteriaId": "5627F10C-7180-4F8A-81D4-A5AB4D42A968"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://aws.amazon.com/security/security-bulletins/2026-013-aws/",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Release Notes"
]
},
{
"url": "https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Patch",
"Product"
]
},
{
"url": "https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Patch",
"Product"
]
},
{
"url": "https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Patch",
"Product"
]
},
{
"url": "https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Patch",
"Product"
]
}
]
}