rewindex

RewindexCVEsAmazon Web Services

CVE-2026-75910: Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Medium · CVSS 6.5 (CVSS 3.1)EPSS 0.50%, 43th percentilePublished Updated Assigner: AMZN

Description

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · CWE-266

Tracked companies

Amazon Web Services

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

AWS: Athena Federated Query Clickhouse Connector deployment template

References

All CVEsMarkdownJSON