CVE-2026-115416: CWE-863 Incorrect authorization in AWS Amazon Athena

Amazon Athena engine version 3 contains an authorization flaw (CWE-863) in its query processing that could permit an authenticated user to read AWS account identifiers and SQL statement text query metadata belonging to other AWS accounts. This exposure is limited to metadata and does not include access to query results or underlying data in Amazon S3 or other data sources. The vulnerability has been assigned CVE-2026-115416 and carries a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). AWS has published a security bulletin (2026-144-AWS) confirming the issue and indicating that a patch is available. As Amazon Athena is a cloud service, AWS manages the remediation process server-side.

An authenticated user with access to Amazon Athena engine version 3 could exploit this vulnerability to read AWS account identifiers and SQL query metadata from other AWS accounts. However, the vulnerability does not allow access to query results or data stored in Amazon S3 or other data sources, limiting the scope of data exposure to metadata only. This could potentially lead to information disclosure about other AWS accounts' query activities.

AWS manages remediation for this cloud-hosted service and has made a patch available. Users should refer to the official AWS Security Bulletin (https://aws.amazon.com/security/security-bulletins/2026-144-aws/) for the latest remediation guidance and ensure their Amazon Athena service is updated accordingly. No additional user action is required beyond applying the vendor's patch or update as provided.