← Back

CVE-2026-35560

nvd nist
Published: Apr 3, 2026Modified: Jul 24, 2026

JSON object

Loading...
9.1
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.

Affected (1)

Products: Amazon: Athena Odbc
Amazon
1 product
Athena Odbc
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Athena Odbc
Before 2.1.0.0
Running on/withPlatform Versions
Apple
Macos
All versions
Linux
Linux Kernel
All versions
Microsoft
Windows
All versions

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (6)

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Vendor Advisory
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Release Notes
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
PatchProduct
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
PatchProduct
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
PatchProduct
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
PatchProduct

Timeline

No history available yet.