LOWVulnerability
Global

Issues with Amazon Athena ODBC Driver

·Source: AWS Security Bulletins

Updated:

Executive Summary

Bulletin ID: 2026-013-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/03 13:00 PM PDT Description: The Amazon Athena ODBC driver implements standard ODBC application program interfaces (APIs). The ODBC driver provides access to Amazon Athena from any C/C++ application. The Amazon Athena ODBC drive

Analysis

Bulletin ID: 2026-013-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/03 13:00 PM PDT Description: The Amazon Athena ODBC driver implements standard ODBC application program interfaces (APIs). The ODBC driver provides access to Amazon Athena from any C/C++ application. The Amazon Athena ODBC driver provides 64-bit ODBC drivers for Windows, Linux and MAC operating systems. We identified the following: - CVE-2026-5485: OS command injection in browser-based authentication component (Linux only, fixed in 2.0.5.1) - CVE-2026-35558: Improper neutralization of special elements in authentication components - CVE-2026-35559: Out-of-bounds write in query processing components - CVE-2026-35560: Improper certificate validation in identity provider connection components - CVE-2026-35561: Insufficient authentication security controls in browser-based authentication components - CVE-2026-35562: Allocation of resources without limits in parsing components Impacted versions: CVE-2026-5485 was addressed in 2.0.5.1 (Linux only). The remaining five (CVE-2026-35558 through CVE-2026-35562) were addressed in version 2.1.0.0 and apply to all supported platforms Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Indicators of Compromise (8)

CVE (6)
CVE-2026-5485
NVDMITRE CVE
CVE-2026-35558
NVDMITRE CVE
CVE-2026-35559
NVDMITRE CVE
CVE-2026-35560
NVDMITRE CVE
CVE-2026-35561
NVDMITRE CVE
CVE-2026-35562
NVDMITRE CVE
Source Attribution

Originally published by AWS Security Bulletins on Jun 5, 2026.

Related Threats

MEDIUMVulnerability

CISA to require federal agencies to patch some cyber vulnerabilities within 3 days

CISA is giving agencies 180 days to adopt the new patching time frame, according to a directive released Wednesday.

The Record
MEDIUMVulnerability

How Federal Agencies Can Activate a Risk Operations Center (ROC) to Meet CISA BOD 26-04

Executive Summary Recognizing the ability of Frontier AI models to discover and exploit vulnerabilities at unprecedented speed and scale, CISA’s Binding Operational Directive (BOD) 26-04 marks a significant shift in federal vulnerability management. Rather than prioritizing remediation based on patch availability, the directive requires agencies to focus on risk-informed, evidence-based deci

Qualys Blog
MEDIUMVulnerability

Presidio launches AI governance platform for financial services

Financial institutions are entering a new operating model shaped by AI, automation, and rising expectations for more personalized, efficient, and compliant client experiences.

Finextra