External risk intelligence

Amazon Athena ODBC Driver Credential Interception Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-35560

The vulnerability affects an ODBC driver, which is a client-side component used by applications to connect to databases. While it handles network connections to identity providers, it is not a public-facing service or listener itself. Public internet exposure of the driver is uncommon, as it typically resides within the environment of the application making the database connection.

Amazon Athena Odbc

before 2.1.0.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Amazon Athena ODBC driver, which could allow an attacker to intercept authentication credentials when connecting to external identity providers. The primary concern is confirming relevance and exposure within your environment.

Weaknesses in driver connection may expose credentials.
It impacts secure connections to external identity providers.
Confirm driver usage and potential exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could intercept authentication credentials by performing a man-in-the-middle attack against connections made by the Amazon Athena ODBC driver to external identity providers. This is possible because the driver improperly validates certificates, and the default transport security is insufficient, allowing an attacker to position themselves between the driver and the identity provider.

Unauthenticated network access required.
Intercepted identity provider connection.
Credential theft and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

When connecting to external identity providers, a man-in-the-middle attacker could intercept authentication credentials due to insufficient transport security in the Amazon Athena ODBC driver. This risk is present when the driver is used with external identity providers and is not applicable to direct connections with Athena.

Authentication credentials could be exposed.
Man-in-the-middle attack is possible.
Compromised user credentials could result.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Amazon Athena ODBC driver's improper certificate validation impacts connections to external identity providers, potentially exposing authentication credentials. Owners of applications utilizing this driver, likely within infrastructure or platform teams, must first identify all deployments of the affected driver, confirm their reachability and criticality, and then coordinate an upgrade to version 2.1.0.0.

Application owners should manage the upgrade.
Verify driver installation and external provider connections.
Plan upgrade during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amazon Athena ODBC driver?

The Amazon Athena ODBC driver is a software component that allows applications, such as reporting tools or data analytics platforms, to connect to Amazon Athena. It acts as a translator between your local applications and the database service, handling the data requests and authentication processes required to access cloud-hosted information.

What is the weakness behind CVE-2026-35560?

This vulnerability is classified as CWE-295, which means there is improper certificate validation. In plain terms, the driver does not strictly verify the digital identity of the identity provider it connects to. Because it fails to properly confirm that it is talking to a legitimate server, an attacker could pose as that provider to intercept sensitive authentication credentials.

How does an attacker trigger this vulnerability?

An attacker must successfully position themselves between the driver and the identity provider to perform a man-in-the-middle attack. Crucially, this bug only impacts connections made to external identity providers. It does not trigger when the driver connects directly to the Athena service, as those specific connections do not utilize the vulnerable authentication path.

Why should I care about this if my software is internal?

Halo Surface Signal indicates this vulnerability is unlikely to be exposed to the public internet because the driver is a client-side tool residing within application environments. However, if your internal network is compromised or untrusted, an attacker with network access could still attempt to intercept these authentication flows.

How do I respond to this threat?

The primary response is to upgrade the driver to version 2.1.0.0 or later. Start by auditing your environment to locate all systems where this specific driver is installed. Once identified, coordinate with your infrastructure or application teams to update the driver software, which resolves the validation weakness and secures the authentication handshake.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.