CVE-2026-35560: Amazon Athena ODBC Auth Bypass Flaw

CVE-2026-35560 Overview

CVE-2026-35560 is a critical improper certificate validation vulnerability (CWE-295) affecting the identity provider connection components in Amazon Athena ODBC driver versions prior to 2.1.0.0. The vulnerability allows a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers.

This security flaw specifically impacts connections with external identity providers and does not apply to direct connections with Athena. Organizations using federated authentication with the Athena ODBC driver should prioritize remediation to prevent credential interception attacks.

Critical Impact
Authentication credentials can be intercepted by man-in-the-middle attackers due to improper certificate validation when connecting to external identity providers, potentially leading to unauthorized access to AWS Athena resources and sensitive data.

Affected Products

Amazon Athena ODBC Driver versions prior to 2.1.0.0 (Windows)
Amazon Athena ODBC Driver versions prior to 2.1.0.0 (Linux)
Amazon Athena ODBC Driver versions prior to 2.1.0.0 (macOS Intel and ARM)

Discovery Timeline

April 3, 2026 - CVE-2026-35560 published to NVD
April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35560

Vulnerability Analysis

The vulnerability resides in the identity provider connection components of the Amazon Athena ODBC driver. When the driver establishes connections with external identity providers for federated authentication, it fails to properly validate SSL/TLS certificates by default. This insufficient transport security implementation creates an opportunity for attackers positioned on the network path between the client and the identity provider.

The improper certificate validation means the driver may accept invalid, expired, or fraudulent certificates without proper verification. This allows an attacker to present a malicious certificate and establish what appears to be a secure connection, while actually intercepting all traffic including sensitive authentication credentials such as usernames, passwords, and authentication tokens.

Root Cause

The root cause is improper certificate validation (CWE-295) in the identity provider connection handling code. The driver's default configuration does not enforce strict certificate validation when establishing TLS connections to external identity providers. This security misconfiguration allows the driver to accept certificates that would otherwise be rejected, including:

Self-signed certificates without proper trust chain
Certificates with hostname mismatches
Expired or revoked certificates
Certificates signed by untrusted certificate authorities

Attack Vector

The attack leverages a network-based man-in-the-middle position. An attacker must be able to intercept network traffic between the victim's system running the Athena ODBC driver and the external identity provider. This could be achieved through:

ARP spoofing on local networks
DNS hijacking
Compromised network infrastructure
Rogue WiFi access points

Once positioned, the attacker presents a fraudulent certificate to the ODBC driver. Due to the improper validation, the driver accepts the certificate and establishes a connection with the attacker's system instead of the legitimate identity provider. The attacker can then capture authentication credentials as they are transmitted.

Since no verified code examples are available, organizations should refer to the AWS Security Bulletin 2026-013 for detailed technical information about the vulnerability and its exploitation mechanics.

Detection Methods for CVE-2026-35560

Indicators of Compromise

Unexpected certificate warnings or errors in application logs related to Athena ODBC connections
Network traffic anomalies showing connections to identity providers being routed through unexpected IP addresses
Authentication failures or unusual login patterns to AWS Athena services
Evidence of ARP spoofing or DNS manipulation targeting identity provider domains

Detection Strategies

Implement network monitoring to detect man-in-the-middle attack indicators such as ARP spoofing or DNS hijacking
Review Athena ODBC driver version inventories across all systems to identify vulnerable installations
Monitor AWS CloudTrail logs for suspicious authentication patterns or unauthorized Athena access
Deploy certificate transparency monitoring for identity provider domains

Monitoring Recommendations

Enable verbose logging for ODBC connections to capture certificate validation details
Configure SIEM rules to alert on connection anomalies between clients and identity providers
Implement endpoint detection to identify outdated Athena ODBC driver installations
Monitor network traffic for connections to identity providers that bypass expected routes

How to Mitigate CVE-2026-35560

Immediate Actions Required

Upgrade Amazon Athena ODBC driver to version 2.1.0.0 or later immediately
Audit all systems using the Athena ODBC driver with external identity provider authentication
Review recent authentication logs for signs of credential compromise
Consider rotating credentials for any accounts that may have been exposed

Patch Information

Amazon has released version 2.1.0.0 of the Athena ODBC driver which addresses this vulnerability. Updated drivers are available for all supported platforms:

Windows: Amazon Athena ODBC Windows Driver
Linux: Amazon Athena ODBC Linux Driver
macOS Intel: Amazon Athena ODBC Mac Intel Driver
macOS ARM: Amazon Athena ODBC Mac ARM Driver

For detailed release notes, see the AWS Athena ODBC Driver Release Notes.

Workarounds

If immediate upgrade is not possible, avoid using external identity provider authentication with vulnerable driver versions
Implement network segmentation to reduce man-in-the-middle attack surfaces
Use VPN connections for all Athena ODBC communications to add an additional encryption layer
Deploy network intrusion detection systems to identify potential MITM attacks

bash

# Verify installed Athena ODBC driver version on Linux
rpm -qa | grep AmazonAthenaODBC

# Verify installed Athena ODBC driver version on Windows (PowerShell)
# Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Athena*ODBC*"} | Select-Object Name, Version