CVE-2026-115416 AWS CVE debrief

Who should care

Defenders responsible for Amazon Athena and AWS account security should assess exposure and verify proper authorization checks are in place. They should also monitor access to sensitive metadata and review configurations to ensure proper authorization. Additionally, security teams and operators managing AWS accounts and Amazon Athena should be aware of the potential risks and take necessary precautions to prevent unauthorized access.

Why it matters

CVE-2026-115416 is a medium-severity vulnerability in Amazon Athena engine version 3 query processing that could allow authenticated users to access AWS account identifiers and SQL statement text query metadata from other accounts. Defenders should verify proper authorization checks are in place and monitor access to sensitive metadata.

• Potential unauthorized access to AWS account identifiers and SQL statement text query metadata.
• Verification of proper authorization checks in Amazon Athena engine version 3 query processing.
• Monitoring of AWS account identifiers and SQL statement text query metadata access.

Technical summary

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. The issue was remediated by AWS on October 7, 2026. Defenders should verify proper authorization checks are in place and monitor access to sensitive metadata to prevent potential unauthorized access.

Defensive priority

Medium

Recommended defensive actions

• Review and verify Amazon Athena engine version 3 query processing configurations to ensure proper authorization checks are in place.
• Monitor AWS account identifiers and SQL statement text query metadata access.
• Verify that no customer action is required as AWS remediated the issue.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the incorrect authorization checks in Amazon Athena engine version 3 query processing. AWS remediated the issue on October 7, 2026. The vulnerability could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results and data stored in Amazon S3 or other data sources were not accessible through this issue. Defenders should verify proper authorization checks are in place and monitor access to sensitive AWS

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.