Incorrect authorization checks in the Athena engine version 3 query processing module allow an authenticated user to retrieve AWS account identifiers and SQL statement text query metadata from other AWS accounts. The vulnerability does not grant direct access to query results or underlying data in Amazon S3; it only exposes accounting and metadata information that could serve as reconnaissance data or enable policy analysis workarounds. The weakness corresponds to forbidden data release (CWE-653) and improper authorization checks (CWE-863).

AWS customers using Amazon Athena with engine version 3 are affected. The issue was fixed by AWS in the October‑7, 2026 release; therefore only environments still running an unpatched version of Athena engine 3 remain vulnerable.

The CVSS score of 6.3 indicates medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity. Attackers would need authenticated access to Athena and would typically target cross‑account metadata, which is a lower‑impact vector compared to direct data exfiltration. The fix applied by AWS removes the security flaw, so the residual risk to customers using updated configurations is negligible.