{"id":"CVE-2026-35560","title":"Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver","summary":"Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default t…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-295"],"vendor":"Amazon","product":"Amazon Athena ODBC driver","affected":["athena_odbc_driver < 2.1.0.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-07T03:55:37.348990Z"},"published":"2026-04-03","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:18:37.998Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35560","references":[{"url":"https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi"},{"url":"https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm"},{"url":"https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg"},{"url":"https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-013-aws/"},{"url":"https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html"}],"tags":["cve.org"],"epss":0.00365,"epssPercentile":0.28896,"ingestedAt":"2026-10-20T19:16:14.553Z","slug":"CVE-2026-35560","body":"## Overview\n\nImproper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena.\n\n\n\nTo remediate this issue, users should upgrade to version 2.1.0.0.\n\n## Affected\n\n- `athena_odbc_driver < 2.1.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}