External risk intelligence

Amazon Athena ODBC Driver Authentication Session Hijacking Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-35561

This vulnerability exists within an ODBC driver, which is a client-side component used by applications to connect to databases. It is not an internet-facing service, gateway, or web application, but rather a library running locally on an end-user or developer workstation or application server to facilitate database connectivity.

Amazon Athena Odbc

before 2.1.0.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a security control weakness in the Amazon Athena ODBC driver's browser-based authentication, which could potentially allow for the interception or hijacking of authentication sessions. The main concern is confirming relevance and exposure within your environment.

Authentication sessions could be hijacked.
Protects against credential theft or session takeover.
Confirm driver usage and update to secure versions.

Attack Path

How an attacker could exploit the issue

An attacker could leverage insufficient security controls in the Amazon Athena ODBC driver's browser-based authentication to intercept or hijack user sessions. This requires the attacker to have some level of access to a system using a vulnerable version of the driver. Successful session interception could lead to unauthorized access to sensitive data within Athena.

Unauthenticated access to a vulnerable system.
Triggering the browser-based authentication flow.
Session hijacking and data interception.

Live Threat

Current exploitation, exposure, and threat context

Insufficient authentication security controls in the Amazon Athena ODBC driver could allow a threat actor to intercept or hijack authentication sessions when users interact with browser-based authentication flows. This could potentially expose sensitive information related to database access.

Authentication sessions and access credentials.
Interception during browser-based authentication flows.
Unauthorized access to database resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Amazon Athena ODBC driver's authentication components are likely managed by application owners or infrastructure teams responsible for data access. The immediate practical step is to identify all instances of the affected driver, confirm their reachability and business criticality, and then plan an upgrade to version 2.1.0.0.

Application owners should manage the issue.
Verify driver installation and usage.
Upgrade driver to the latest version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amazon Athena ODBC driver?

The Amazon Athena ODBC driver is a software library that enables applications, such as data analytics tools or custom programs, to connect to and query Amazon Athena databases. It acts as a translator between your local software and the Athena service, facilitating secure communication. Because it is a client-side component, it is installed directly on user workstations or application servers rather than running as a standalone internet-facing service.

What does CWE-862 mean for CVE-2026-35561?

CWE-862 refers to Missing Authorization. In the context of this vulnerability, it means the driver fails to properly verify or enforce authentication controls during browser-based login flows. Because the software does not correctly manage the security of these specific communication steps, an attacker could potentially gain unauthorized access by intercepting or taking over the session being established between the driver and the authentication service.

How is this authentication vulnerability triggered?

The vulnerability is triggered specifically when a user initiates the browser-based authentication flow within the affected driver. If the user does not use this browser-based method, or if they are not actively performing an authentication event, this specific path is not triggered. The flaw requires the authentication process to be in motion to provide an opportunity for an attacker to interfere with the session.

Is my system at risk if it uses this driver?

According to Halo Surface Signal, this risk is very unlikely for typical internet-facing services because the driver is a client-side library used locally by applications. It is not a gateway or web application exposed directly to the public. You should primarily focus on environments where users or applications utilize the driver to interact with sensitive databases, as that is where the session hijacking concern is most relevant.

What is the first step to fix this issue?

The recommended action is to identify all machines or servers where the Amazon Athena ODBC driver is installed. Once you have located these instances, you should plan and execute an upgrade to version 2.1.0.0 or higher. This update contains the necessary security improvements to the authentication components that resolve the identified session hijacking risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.