216.73.217.22

CVE-2026-35560

· Published 03/04/2026 21:17 · Modified 03/04/2026 21:17

Labels: CVE-2026-35560 2026-04-03CVE-2026-35560CWE-295ff89ba41-3aa1-4d27-914a-91399e9639e5

Essential information

Published
03/04/2026 21:17
Modified
03/04/2026 21:17
Author
—
Creator
—
CVSS
9.1 CRITICAL (v3) 9.1 CRITICAL (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD
View on NVD

Affected products (CPE)

ProductCPE
amazon / amazon athena odbc driver cpe:2.3:a:amazon:amazon_athena_odbc_driver:<2.1.0.0:*:*:*:*:*:*:*

References