CVE-2026-35560
Improper Certificate Validation in Amazon Athena ODBC Driver Enables MITM
Publication date: 2026-04-03
Last updated on: 2026-04-14
Assigner: AMZN
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amazon | athena_odbc | to 2.1.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to improper certificate validation in the identity provider connection components of the Amazon Athena ODBC driver versions before 2.1.0.0.
Because of insufficient default transport security when connecting to external identity providers, a man-in-the-middle attacker might be able to intercept authentication credentials.
This issue does not affect connections directly with Athena, only those involving external identity providers.
The recommended fix is to upgrade the driver to version 2.1.0.0 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves improper certificate validation in the Amazon Athena ODBC driver, which might allow a man-in-the-middle attacker to intercept authentication credentials. This interception of credentials could potentially lead to unauthorized access to sensitive data.
Such unauthorized access risks could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding authentication credentials and protecting personal or sensitive data from unauthorized disclosure.
However, the provided information does not explicitly describe the direct effects on compliance with these standards or regulations.
How can this vulnerability impact me? :
This vulnerability can allow an attacker positioned as a man-in-the-middle to intercept authentication credentials when the Amazon Athena ODBC driver connects to external identity providers.
Such interception could lead to unauthorized access to systems or data that rely on those credentials for authentication.
The impact includes potential compromise of confidentiality and integrity of authentication processes.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should upgrade the Amazon Athena ODBC driver to version 2.1.0.0 or later.