CVE-2026-35561: Amazon Athena ODBC driver insufficient authentication controls

CVE-2026-35561 · Severity: high · CVSS 7.4 · Published 2026-04-03

The Amazon Athena ODBC driver, which allows applications to connect to and query data in Amazon Athena, contains a security flaw in its browser-based login process. An attacker could potentially intercept or hijack a user's authentication session, leading to unauthorized access to data and resources. This issue affects users on Windows, Linux, and macOS who use browser-based login methods.

Technologies: Amazon Athena Odbc, Apple macOS, Linux Kernel, Microsoft Windows. Vendors: Amazon, Apple, Linux, Microsoft.

Quick answers

Is CVE-2026-35561 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35561 being exploited in the wild.
How severe is CVE-2026-35561?
High severity, with a CVSS score of 7.4, published 3 April 2026.
Which products and versions are affected?
Amazon Amazon Athena ODBC driver < 2.1.0.0.
Is there a fix for CVE-2026-35561?
A patch was published on 2026-03-20: Version 2.1.0.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35561 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35561?
Check whether you run Amazon Athena Odbc, Apple macOS, Linux Kernel or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Amazon Athena ODBC driver prior to version 2.1.0.0 suffers from missing authorization and session security controls (CWE-862) within its browser-based authentication plugins (BrowserSSOOIDC, BrowserAzureAD, and BrowserSAML). Specifically, the driver lacked PKCE (Proof Key for Code Exchange) for OAuth flows and RelayState CSRF protection for SAML, making it vulnerable to authorization code interception and SAML token injection attacks. An unauthenticated remote attacker could exploit these weaknesses to hijack authentication sessions. The vulnerability is resolved in version 2.1.0.0, which migrates to Authorization Code with PKCE, implements CSRF protections, and enforces stricter TLS 1.2+ requirements.

Affected products

  • Amazon Amazon Athena ODBC driver < 2.1.0.0

Timeline

  • 2026-03-20: patched: Version 2.1.0.0 released
  • 2026-04-03: disclosed: Initial advisory published by Amazon
  • 2026-04-03: advisory: NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.