CVE-2026-107352

Katalog CVE

CVSS 7.7 · High EPSS 0,20%

Kerentanan Improper Protection of Alternate Path. Skor CVSS 3.1 7.7 (High) menurut CNA.

Deskripsi (NVD)

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

Rincian

Terbit di NVD

7 Oktober 2026

Terakhir diubah

11 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.7 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-424: Improper Protection of Alternate Path
CWE-862: Missing Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-128-aws/