7.4
High
CVE-2026-35560 Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before…
Description
Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Amazon Athena ODBC driver 2.1 | earliest → < 2.1.0.0 | 2.1.0.0 |
Other CVEs of Amazon Athena ODBC driver
The 6 CVEs of Amazon Athena ODBC driver →
CVE-2026-35558
Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0…
7.8
High
CVE-2026-35559
Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a…
6.5
Medium
CVE-2026-5485
OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on…
7.8
High
CVE-2026-35562
Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow…
7.5
High