CVE-2026-65321 laughingman7743 CVE debrief

Who should care

Users of PyAthena, especially those using versions prior to 3.35.4, should be aware of this critical vulnerability and take immediate action to mitigate the risk. This includes inventorying PyAthena installations, verifying the version, and implementing compensating controls to detect and prevent SQL injection attacks. Security teams and vulnerability management teams should prioritize this vulnerability due to its critical severity and potential for data exfiltration and destructive attacks. Additionally, operators and platform administrators should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance, and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring and detection teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review, and track exceptions and retest remediated assets to ensure that the vulnerability is properly addressed. Asset inventory and change management processes should be updated to reflect the need for urgent remediation of this vulnerability. Finally, source tracking and incident response teams should be prepared to respond to potential exploitation attempts and have a plan in place to quickly verify and remediate any potential exposures. This vulnerability requires immediate attention and swift action to prevent potential exploitation and minimize the risk of data exfiltration or destructive attacks. The operational impact of this vulnerability can be significant if exploited, making it essential for affected organizations to take prompt action to protect their assets and data. The vulnerability's critical severity and potential for significant impact make it essential for security teams to prioritize this vulnerability and ensure that all necessary steps are taken to mitigate the risk. The affected product or component is PyAthena, and the vulnerability class is SQL injection. The likely operational impact of exploitation could include data exfiltration, execution of destructive statements, and unauthorized access to sensitive data. The source-confidence limits of this CVE are

Technical summary

The vulnerability exists in PyAthena prior to version 3.35.4, allowing unauthenticated attackers to inject arbitrary SQL due to improper quote-escaping in DefaultParameterFormatter.format(). This allows for data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content. The vulnerability is caused by backslash-escaping single quotes rather than doubling them, which is not treated as an escape character by Athena and Trino inside string literals.

Defensive priority

Critical vulnerability in PyAthena, allowing unauthenticated SQL injection via improper quote-escaping, requires immediate attention.

Recommended defensive actions

• Inventory PyAthena installations and verify version 3.35.4 or later is deployed.
• Implement compensating controls to detect and prevent SQL injection attacks.
• Monitor for suspicious activity and exception tracking.
• Apply vendor remediation when available.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in PyAthena prior to version 3.35.4, allowing unauthenticated attackers to inject arbitrary SQL due to improper quote-escaping in DefaultParameterFormatter.format(). Limited information available on affected scope and vendor remediation efforts. Further verification is needed to determine the full impact and to confirm if there are any workarounds or patches available.

Official resources