Description
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax.



Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name.



To remediate this issue, users should upgrade to version v2026.21.1 or later.
Published: 2026-07-17
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a classic SQL injection flaw in the Amazon Athena Query Federation Synapse connector that allows an authenticated remote user to craft a table name containing injected SQL. The injection is executed as a read‑only query and can return data from the connected Azure Synapse database that the user would normally not have access to. The flaw arises from improper neutralization of special elements used in an SQL command.

Affected Systems

The affected product is Amazon Athena Query Federation, specifically the Synapse connector component. Versions of the connector released between v2022.20.1 and v2026.19.1 are vulnerable. Users should verify the connector version in use and compare it with the safe release v2026.21.1 or newer.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate impact. The EPSS score of less than 1% suggests a very low likelihood of exploitation presently, and the issue is not listed in CISA KEV. Exploitation requires that the attacker be authenticated to the Athena Query Federation service and able to submit queries that reference a Synapse table. Because the injection is limited to read‑only operations, the primary risk is unauthorized disclosure of sensitive data, which could be used for further attacks if it contains valuable information.

Generated by OpenCVE AI on July 30, 2026 at 23:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Amazon Athena Query Federation to version 2026.21.1 or later.
  • Restrict the use of the Synapse connector to roles that require it and enforce the principle of least privilege.
  • Enable query logging and audit logs to detect and investigate unusual table references that may indicate injection attempts.

Generated by OpenCVE AI on July 30, 2026 at 23:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Description Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name. To remediate this issue, users should upgrade to version v2026.21.1 or later.
Title SQL injection in Amazon Athena Synapse connector
First Time appeared Aws
Aws aws-athena-query-federation
Weaknesses CWE-89
CPEs cpe:2.3:a:aws:aws-athena-query-federation:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-athena-query-federation
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Aws Aws-athena-query-federation
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-07-17T19:43:21.238Z

Reserved: 2026-06-15T13:56:10.694Z

Link: CVE-2026-12283

cve-icon Vulnrichment

Updated: 2026-07-17T19:43:14.268Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T00:00:06Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')