The vulnerability CVE-2026-35560 concerns improper certificate validation (CWE-295) in the Amazon Athena ODBC driver versions prior to 2.1.0.0. Specifically, the identity provider connection components fail to sufficiently validate certificates when establishing connections to external identity providers, leading to potential interception of authentication credentials by man-in-the-middle attackers. This flaw does not impact connections made directly to Athena itself. The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. The vendor advisory from AWS recommends upgrading to version 2.1.0.0 to address this issue.

Successful exploitation of this vulnerability could allow an attacker positioned on the network path to intercept authentication credentials during connections to external identity providers, potentially compromising user authentication. The confidentiality and integrity of authentication credentials are at risk, but availability is not impacted. This vulnerability does not affect direct connections to Athena, limiting the scope to identity provider connections only.

Users should upgrade the Amazon Athena ODBC driver to version 2.1.0.0 or later, as recommended by the AWS security advisory. This upgrade addresses the improper certificate validation issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified or required beyond applying the official update.