CVE-2026-75910 - Issue with Athena Federated Query Clickhouse Connector
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value.
AI Analysis
Technical Summary
Amazon Athena's Federated Query feature allows querying external data sources via connectors such as the ClickHouse connector. Before version V2026.17.1, the ClickHouse connector deployment template had incorrect privilege assignments. This flaw could be exploited by an authenticated remote user who configures the connector's connection string to reference an unrelated AWS Secrets Manager secret and a database endpoint under their control. As a result, the connector would transmit the secret to the attacker's endpoint, exposing sensitive credentials. The issue is resolved in aws-athena-query-federation version V2026.17.1. Users should upgrade to this version or later and ensure any forks or derivatives are patched accordingly. A workaround involves redeploying the connector with the updated template and specifying a non-empty SecretNamePrefix.
Potential Impact
An authenticated remote user can read arbitrary AWS Secrets Manager secrets in the deploying AWS account by exploiting the incorrect privilege assignment in the ClickHouse connector deployment template. This exposure could lead to unauthorized access to sensitive credentials stored in Secrets Manager, potentially compromising other AWS resources or services that rely on those secrets.
Mitigation Recommendations
This vulnerability has been addressed in aws-athena-query-federation version V2026.17.1. Users should upgrade to this version or later to remediate the issue. Additionally, users should redeploy the connector using the current deployment template and supply a non-empty SecretNamePrefix value as a workaround if immediate upgrading is not possible. Ensure that any forked or derivative code is also patched to incorporate these fixes.
CVE-2026-75910 - Issue with Athena Federated Query Clickhouse Connector
Description
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value.
Affected software
pkg:github/awslabs/aws-athena-query-federation-connectorsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Amazon Athena's Federated Query feature allows querying external data sources via connectors such as the ClickHouse connector. Before version V2026.17.1, the ClickHouse connector deployment template had incorrect privilege assignments. This flaw could be exploited by an authenticated remote user who configures the connector's connection string to reference an unrelated AWS Secrets Manager secret and a database endpoint under their control. As a result, the connector would transmit the secret to the attacker's endpoint, exposing sensitive credentials. The issue is resolved in aws-athena-query-federation version V2026.17.1. Users should upgrade to this version or later and ensure any forks or derivatives are patched accordingly. A workaround involves redeploying the connector with the updated template and specifying a non-empty SecretNamePrefix.
Potential Impact
An authenticated remote user can read arbitrary AWS Secrets Manager secrets in the deploying AWS account by exploiting the incorrect privilege assignment in the ClickHouse connector deployment template. This exposure could lead to unauthorized access to sensitive credentials stored in Secrets Manager, potentially compromising other AWS resources or services that rely on those secrets.
Mitigation Recommendations
This vulnerability has been addressed in aws-athena-query-federation version V2026.17.1. Users should upgrade to this version or later to remediate the issue. Additionally, users should redeploy the connector using the current deployment template and supply a non-empty SecretNamePrefix value as a workaround if immediate upgrading is not possible. Ensure that any forked or derivative code is also patched to incorporate these fixes.
Technical Details
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-084-aws/","fetched":true,"fetchedAt":"2026-08-20T20:19:49.171Z","wordCount":244}
Threat ID: 6a876165acd9273b49152c59
Added to database: 08/20/2026, 20:19:49 UTC
Last enriched: 08/20/2026, 20:20:01 UTC
Last updated: 08/20/2026, 20:53:47 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.