AWS Remediates Athena Engine v3 Cross-Account Metadata Disclosure
Tech GuruQuick Answer
AWS bulletin 2026-144-AWS says its October 7 service remediation resolved CVE-2026-115416 and no customer action is required. Organizations should confirm relevant Athena use, decide whether exposed query metadata warrants review, and retain the assessment.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify accounts and workloads that used Athena engine version 3 before October 7, including sensitive query text and accountable owners. Distinguish query metadata from source data; AWS says Amazon S3 and other queried data were not accessible through this issue. Do not invent a customer patch: AWS states that the service was remediated and no customer action is required. Confirm current service status, document the applicability decision, review CloudTrail and query history if the metadata risk warrants it, and retain evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Amazon Athena engine version 3 |
|---|---|
| Advisory | 2026-144-AWS |
| CVE | CVE-2026-115416 |
| Authoritative release date | 2026-10-22 16:58:02 UTC |
| Authority revision date | 2026-10-22 16:58:02 UTC |
| Affected versions | Athena engine version 3 before the AWS service remediation deployed October 7, 2026; the issue exposed query metadata, not the underlying Amazon S3 or other source data. |
| Fixed version | AWS service remediation deployed October 7, 2026; no customer action required |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that this issue was maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS corrected missing authorization checks that could disclose query strings, execution plans, and resource metadata across customer accounts in Athena engine version 3.
What To Validate Now
- Inventory. Identify accounts and workloads that used Athena engine version 3 before October 7, including sensitive query text and accountable owners.
- Establish applicability. Distinguish query metadata from source data; AWS says Amazon S3 and other queried data were not accessible through this issue.
- Remediate. Do not invent a customer patch: AWS states that the service was remediated and no customer action is required.
- Validate. Confirm current service status, document the applicability decision, review CloudTrail and query history if the metadata risk warrants it, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The authority does not provide a CVSS score or allege source-data access or exploitation. Avoid rotating credentials or changing data permissions solely because Athena engine version 3 was used.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
