CVE-2026-75910 - Issue with Athena Federated Query Clickhouse Connector
Description
CVE-2026-75910 is a vulnerability in the Amazon Athena Federated Query ClickHouse connector deployment template prior to version V2026.17.1. It involves incorrect privilege assignment that could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account. This is achieved by manipulating the connector's connection string to point at an unrelated secret and a database endpoint controlled by the attacker, causing the secret to be transmitted to that endpoint. The issue has been fixed in version V2026.17.1. Users are advised to upgrade to this version or later and can mitigate the issue by redeploying the connector with the current template and setting a non-empty SecretNamePrefix value.
Affected software
pkg:github/awslabs/aws-athena-query-federation-connectorsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Amazon Athena's Federated Query feature allows querying external data sources via connectors, including the ClickHouse connector. Before version V2026.17.1, the ClickHouse connector deployment template had incorrect privilege assignments. This flaw could be exploited by an authenticated remote user who controls a database endpoint and manipulates the connector's connection string to access arbitrary AWS Secrets Manager secrets within the deploying AWS account. The secret data would then be transmitted to the attacker's endpoint. The vulnerability is resolved in aws-athena-query-federation version V2026.17.1. Workarounds include redeploying the connector with the updated template and specifying a non-empty SecretNamePrefix.
Potential Impact
An authenticated remote user with the ability to influence the connector's connection string could read arbitrary AWS Secrets Manager secrets in the affected AWS account. This exposure could lead to unauthorized disclosure of sensitive credentials or secrets stored in AWS Secrets Manager. The impact is limited to accounts deploying vulnerable versions of the ClickHouse connector with the flawed template.
Mitigation Recommendations
A fix is available in aws-athena-query-federation version V2026.17.1. Users should upgrade to this version or later to remediate the vulnerability. Additionally, as a workaround, redeploy the connector using the current deployment template and ensure that the SecretNamePrefix parameter is set to a non-empty value to prevent unauthorized secret disclosure. Users should also verify that any forked or derivative code incorporates these fixes.
Technical Details
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-084-aws/","fetched":true,"fetchedAt":"2026-08-20T20:19:49.171Z","wordCount":244}
Threat ID: 6a876165acd9273b49152c59
Added to database: 08/20/2026, 20:19:49 UTC
Last enriched: 09/11/2026, 04:18:12 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 125
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.