CVE-2026-107352

Executive Summary

CVE-2026-107352 is a missing authorization vulnerability in the Amazon Athena engine version 3 request handling layer that could have allowed an authenticated AWS user to read limited query metadata — specifically AWS account identifiers and SQL statement text — belonging to other AWS accounts. The flaw is scoped to metadata exposure only: query results, credentials, and Amazon S3 data were unaffected, and AWS states no customer metadata was actually accessed. AWS remediated the issue on September 1, 2026, and no customer action is required; the vulnerability carries a CVSS v3.1 base score of 7.7 due to high confidentiality impact and changed scope despite the query-level low privileges required.

Technical Analysis

The vulnerability resides in the request-handling path of Amazon Athena engine version 3, the query execution engine underlying the Athena serverless interactive query service. According to the NVD description, the defect class is missing authorization checks (CWE-424 — Improper Protection of Alternate Path). In practice, this means that an authenticated principal interacting with the engine's request-handling layer could reach a code path that neither validated the caller's authorization to access the target resource nor enforced tenant (AWS account) isolation boundaries.

The exposure is bounded and specific per the authoritative description:

• Exposed data: limited query metadata — AWS account identifiers and SQL statement text belonging to other AWS accounts.
• Data confirmed NOT affected: query results, credentials (IAM or otherwise), and Amazon S3 data.

This is a horizontal cross-tenant authorization failure. An authenticated user in Account A could obtain metadata artifacts associated with query activity in Account B. The scope change (CVSS S:C) reflects that the vulnerable Athena engine component, once reached with valid low-privilege credentials, could affect resources or data logically owned by a different security authority — i.e., separate AWS accounts in a multi-tenant cloud environment. The PR:L metric indicates that some form of authenticated access to the Athena service was required, not anonymous internet access. The AC:L reflects that no special conditions or race windows were required beyond authenticated access. The C:H / I:N / A:N subscores confirm the impact is purely confidentiality-focused, with no integrity or availability consequences.

No code-level function names, API operation names, or request parameters are disclosed in the NVD description or CNA title. All implementation details remain subject to AWS's internal remediation, which was completed on September 1, 2026. AWS explicitly stated no customer metadata was accessed, meaning there is no confirmed exposure event — this is a post-remediation disclosure of a potential issue, not an active breach report.

Because the flaw is a missing authorization check in a server-side managed service, there is no client-side patch, no version pin a customer can flip, and no downloadable fixed artifact. The remediation was applied by AWS to the managed engine itself.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-107352. The attack chain below is inferred strictly from the vulnerability class (CWE-424, horizontal authorization failure in a multi-tenant request handler) and the NVD description. No specific function names, endpoints, API parameters, or request structures are invented here because none are disclosed.

1. Reconnaissance / target identification. The adversary possesses valid, low-privileged AWS credentials for at least one account with some level of access to Amazon Athena. The objective is to identify that Athena engine version 3 is in use — a common default for modern Athena workgroups — and to determine whether the account's role or workgroup configuration grants any query-execution or metadata-access permissions at all. No external scanning of a public endpoint is required; the attack surface is the authenticated control/data plane of a managed service, consistent with the AV:N / PR:L vector.

2. Triggering the specific flaw class (missing authorization). The attacker submits requests to the Athena engine's request-handling interface using their own authenticated identity but crafts them to reference or enumerate resources associated with a different AWS account. Because the authorization check protecting alternate access paths is absent (CWE-424), the engine fails to verify that the calling principal is entitled to the metadata being returned. There is no injection, no deserialization, and no memory-corruption primitive — the vulnerability is purely a logic/authorization gap. The attacker does not need elevated privileges; a standard authenticated principal is sufficient (PR:L).

3. Payload / execution method (class level). The "payload" is simply a legitimately formed request issued by an authenticated principal against the engine, differentiated from normal traffic only by the fact that the target of the request belongs to another tenant. There is no malicious file, shellcode, or serialized object. Success requires only that the request reaches the vulnerable code path before the (missing) authorization check would have terminated it.

4. Post-exploitation impact. On success, the attacker obtains limited metadata: AWS account identifiers and SQL statement text from other AWS accounts. This metadata is reconnaissance-grade intelligence. SQL text can reveal table names, column names, schema structure, business logic, and data-access patterns; account identifiers enable targeting and correlation. Notably, query results, credentials, and S3 data remain inaccessible, so this does not yield direct access to customer data stores. The value of the primitive is fingerprinting and intelligence gathering to support subsequent, more targeted attacks.

AWS has stated it confirmed no customer metadata was accessed, so there is no evidence this chain was exercised in the wild.

Impact Assessment

The CVSS v3.1 base score is 7.7 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N:

• Attack Vector: Network (N) — the Athena control/data plane is reachable over the network to authenticated principals; no local or adjacent access is required.
• Attack Complexity: Low (L) — no race conditions, no specialized conditions; a properly authenticated request is sufficient.
• Privileges Required: Low (L) — a standard authenticated AWS principal with baseline Athena access suffices; administrative rights are unnecessary.
• User Interaction: None (N) — no victim must click, approve, or otherwise participate.
• Scope: Changed (C) — exploitation crosses a trust/security boundary into another AWS account's metadata namespace.
• Confidentiality: High (H) — cross-account metadata (account IDs, SQL text) is exposed.
• Integrity: None (N) and Availability: None (N) — no data modification or service disruption.

Business impact is bounded but non-trivial. The leaked metadata — account identifiers and SQL statement text — is a high-value reconnaissance input. SQL statements frequently embed schema knowledge, table/column naming conventions, join logic, and hints about sensitive datasets. In aggregate across many queries, this can map the structure of an organization's analytics estate without ever touching the underlying data. Cross-account account identifiers enable adversary mapping of multi-tenant or multi-account AWS organizations, supporting targeted follow-on activity (e.g., privilege escalation attempts or social engineering).

Blast radius: any AWS customer running Amazon Athena engine version 3 before September 1, 2026, in a configuration where cross-account metadata enumeration was reachable with low-privileged credentials. Because Athena is a fully managed serverless service, the exposure is not limited to self-hosted deployments — it applied across the managed fleet until AWS applied the fix. Multi-tenant risk is heightened for AWS Organizations users whose account IDs and SQL posture could be correlated. There is no integrity or availability impact, and AWS's confirmation that no customer metadata was accessed substantially limits the realized business impact.

Detection Guidance

Sigma Rule

title: Suspicious Cross-Account Athena Query Metadata Access Attempt (CVE-2026-107352)
id: 8f3c1a2e-9b4d-4c7a-b1e2-0d5a6f7c8e91
status: experimental
description: Detects AWS CloudTrail Athena query/GetQueryExecution activity from a principal in one account referencing or enumerating metadata belonging to another account, consistent with the missing authorization flaw remediated in Athena engine v3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107352
author: valtersit.com
date: 2026/01/01
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventSource: athena.amazonaws.com
    eventName:
      - StartQueryExecution
      - GetQueryExecution
      - GetQueryResults
      - ListQueryExecutions
      - BatchGetQueryExecution
  selection_crossaccount:
    recipientAccountId: '*'
  filter_self:
    userIdentity.accountId|equalsfield: recipientAccountId
  condition: selection_event and selection_crossaccount and not filter_self
falsepositives:
  - Legitimate cross-account analytics via assumed roles with explicit trust
  - Centralized security/monitoring accounts querying on behalf of member accounts
level: medium
tags:
  - attack.t1213
  - cve.2026.107352

YARA Rule

rule CVE_2026_107352_Athena_CrossAccount_Metadata_Probe
{
    meta:
        description = "Heuristic detection of request artifacts consistent with cross-account Athena engine v3 metadata enumeration (CVE-2026-107352)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107352"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $athena = "athena" ascii wide nocase
        $enginev3 = "engine" ascii wide nocase
        $acct = "account" ascii wide nocase
        $acctid = "accountId" ascii wide
        $querytext = "QueryString" ascii wide
        $sql = "SELECT" ascii wide nocase
        $sqln = /\bSELECT\b.{0,2048}\bFROM\b/ ascii wide nocase

    condition:
        ($athena and $enginev3 and ($acct or $acctid)) or
        ($querytext and ($sql or $sqln))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107352 Possible Amazon Athena Cross-Account Query Metadata Access"; flow:established,to_server; http.host; content:"athena"; http.uri; content:"StartQueryExecution"; http.header; content:"x-amz-target"; content:"AmazonAthena"; http.header; content:"x-amz-security-token"; classtype:attempted-recon; reference:cve,2026-107352; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107352; sid:2026107352; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.id with maxspan=5m
  [any where event.dataset == "aws.cloudtrail" and
     event.action in ("StartQueryExecution", "GetQueryExecution", "ListQueryExecutions", "BatchGetQueryExecution") and
     aws.cloudtrail.event_source == "athena.amazonaws.com" and
     aws.cloudtrail.user_identity.account_id != aws.cloudtrail.recipient_account_id]
  [any where event.dataset == "aws.cloudtrail" and
     event.action in ("GetQueryExecution", "GetQueryResults", "BatchGetQueryExecution") and
     aws.cloudtrail.event_source == "athena.amazonaws.com" and
     aws.cloudtrail.error_code in ("AccessDenied", "AccessDeniedException")]

Splunk SPL Query

index=aws sourcetype=aws:cloudtrail eventSource="athena.amazonaws.com"
    (eventName="StartQueryExecution" OR eventName="GetQueryExecution" OR eventName="GetQueryResults"
     OR eventName="ListQueryExecutions" OR eventName="BatchGetQueryExecution")
| eval caller_account=coalesce('userIdentity.accountId', userIdentity.accountId)
| eval target_account=recipientAccountId
| where caller_account != target_account
| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as actions
        values(requestParameters.queryExecutionId) as query_ids
        by caller_account target_account userIdentity.arn sourceIPAddress
| where count >= 3
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="aws_cloudtrail,athena,">
  <rule id="107352" level="10">
    <if_sid>80200</if_sid>
    <field name="aws.eventSource">athena.amazonaws.com</field>
    <field name="aws.eventName">StartQueryExecution|GetQueryExecution|GetQueryResults|ListQueryExecutions|BatchGetQueryExecution</field>
    <field name="aws.userIdentity.accountId" negate="yes">^$</field>
    <description>CVE-2026-107352: Amazon Athena cross-account query metadata access attempt detected</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_107352,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The "unpatched" status here reflects the absence of any tracked patch artifact or CVE-level remediation reference in the vulnerability feeds. It does not mean the issue remains live: AWS is the sole entity that can remediate a managed service, and AWS states it remediated the flaw on September 1, 2026, and that no customer action is required. There is no customer-applicable version to upgrade because Athena engine v3 is delivered as a managed service; there is no downloadable binary, container tag, or package fix in this report's data.

1. Immediate mitigations (within customer control).

   • Treat the AWS remediation as authoritative and confirm your account is consuming the current engine v3 build; there is no customer-controlled patch lever.
   • Restrict who can invoke Athena query operations. Scope Athena permissions (StartQueryExecution, GetQueryExecution, GetQueryResults, and related metadata operations) to the minimum set of identities that require them, using least-privilege IAM policies and permission boundaries.
   • Reduce cross-account reachability: audit resource-based and identity-based policies that permit principals from other accounts to interact with your Athena workgroups and catalogs, and remove unnecessary trust where the business case no longer applies.
   • Enforce SCP guardrails at the AWS Organizations level to constrain high-risk query operations to approved accounts/roles.
   • Keep CloudTrail enabled in all regions with multi-account aggregation into a centralized security account, and retain Athena StartQueryExecution/GetQueryExecution history long enough for retrospective review of the pre-fix window.

2. Patch / upgrade steps.

   • No customer-side upgrade is required or technically possible for the managed engine. If AWS publishes a formal security bulletin or configuration note, apply any recommended workgroup or engine-setting changes.
   • For any self-managed or federated query components that front Athena, verify you are on the latest vendor-supported release distributed through your normal patching channel.
   • Re-validate that the organization's Athena deployments are on engine version 3 as AWS directs; do not attempt to pin to a vulnerable engine build.

3. Long-term hardening.

   • Adopt a zero-trust posture for data-plane services: every request to a query engine should be authorized against the exact target resource and owning account, not assumed trustworthy because the caller is authenticated.
   • Continuously monitor CloudTrail for cross-account metadata operations that exceed legitimate analytics patterns (see Detection Guidance).
   • Classify and minimize sensitive content in SQL text where feasible, since SQL statements themselves are a reconnaissance surface; avoid embedding secrets or sensitive identifiers directly in query strings.
   • Mature multi-account governance: standardize account identifiers handling, use AWS Organizations SCPs, and periodically review cross-account trust relationships.
   • Track AWS Security Bulletins and subscribe to security notification channels so managed-service remediations are captured without reliance on third-party patch feeds.

References

• NVD — CVE-2026-107352: https://nvd.nist.gov/vuln/detail/CVE-2026-107352
• CWE-424 — Improper Protection of Alternate Path: https://cwe.mitre.org/data/definitions/424.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• AWS Security Bulletins (managed-service remediation notices): https://aws.amazon.com/security/security-bulletins/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-107352 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: None observed. EPSS is 0.00201 (~9.1th percentile of exploited CVEs), reflecting a low near-term exploitation probability. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing exist. AWS has stated it confirmed no customer metadata was accessed, indicating no confirmed in-the-wild exploitation.