CVE-2026-35560
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena.
Risk Assessment
A man-in-the-middle attacker may intercept user authentication credentials, potentially leading to unauthorized access. The risk is limited to scenarios involving external identity providers.
Recommendation
Upgrade the Amazon Athena ODBC driver to version 2.1.0.0 or later. Ensure connections to identity providers use proper certificate validation.
Other vulnerabilities in Amazon Athena ODBC driver
See all- CVE-2026-5485High
OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection.
- CVE-2026-35562High
Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of service by delivering crafted input that triggers excessive resource consumption during the driver's parsing operations.
- CVE-2026-35561High
Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows.
- CVE-2026-35559Medium
Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the driver by using specially crafted data that is processed by the driver during query operations.
- CVE-2026-35558High
The Amazon Athena ODBC driver before version 2.1.0.0 improperly neutralizes special elements in its authentication components. This may allow a threat actor to execute arbitrary code or redirect authentication flows using specially crafted connection parameters processed by the driver during user-initiated authentication.
Original NVD description (English source)
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS