External risk intelligence

PyAthena SQL Injection via Improper Quote Escaping

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65321

PyAthena is a Python client library used to connect to Amazon Athena. It is typically embedded within backend applications or data processing scripts rather than being a standalone, internet-facing service. While it processes data, its usage pattern is generally internal to an application's infrastructure, making direct public-internet exposure uncommon.

SQL Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the PyAthena library allows for the injection of SQL commands by unauthenticated attackers. This occurs when improper handling of quote escaping in specific statement types allows malicious input to be misinterpreted by the database parser. The potential impact includes unauthorized data access, modification, or deletion, as well as the creation of attacker-controlled tables.

SQL injection flaw in data access library.
Unauthenticated access to data or system control.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a flaw in how PyAthena handles certain SQL statements by sending specially crafted input. This crafted input bypasses the intended escaping mechanism, allowing the attacker to manipulate SQL queries. The vulnerability can lead to unauthorized data access, modification, or the creation of new data structures.

No authentication required.
Improper quote escaping in formatter.
Leads to data exfiltration and execution.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in PyAthena could allow unauthenticated attackers to execute arbitrary SQL commands. This occurs when improperly escaped single quotes in delete and CTAS statements allow for premature termination of string literals, enabling data exfiltration or destructive actions. The impact is contingent on the specific usage and configuration within an affected application.

Database data could be exfiltrated or modified.
Attackers may inject malicious SQL queries.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PyAthena library's SQL injection vulnerability primarily impacts teams responsible for data processing and applications that interact with data warehouses. These could include data engineering, backend development, or platform teams. The initial step should be to identify all applications and services using PyAthena, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Data engineering and application owners.
Confirm PyAthena usage and exposure.
Plan remediation or implement temporary controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PyAthena?

PyAthena is a Python library that enables applications to connect to and interact with Amazon Athena, a serverless query service. It acts as a bridge, allowing developers to run SQL queries against data stored in S3 directly from their Python code, often facilitating data analysis, reporting, and backend data processing tasks.

What is the vulnerability in CVE-2026-65321?

This is a SQL injection vulnerability (CWE-89) stemming from how PyAthena formats certain SQL commands. When processing DELETE or CTAS statements, the library incorrectly handles single quotes by using backslashes. Because the underlying database engines do not recognize these backslashes as escape characters, an attacker can prematurely break out of a string literal to inject their own malicious SQL commands.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by providing input containing a single quote followed by malicious SQL syntax to a vulnerable PyAthena function. The bug does not trigger if the application avoids using the affected DefaultParameterFormatter for DELETE or CTAS statements, or if the input is strictly validated by the application before it ever reaches the library.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that PyAthena is typically used as an internal component within backend services or data scripts rather than as an internet-facing application. While this makes direct exposure to the public internet less common, your specific risk depends on whether any user-controllable inputs in your public-facing apps are passed directly into PyAthena's formatter.

What should I do if I use PyAthena?

First, perform an audit to identify all services in your environment that utilize PyAthena. Once identified, evaluate whether those services process untrusted user input that might reach the formatter. Prioritize updating the library to a patched version, and ensure your team reviews the specific usage patterns of DELETE and CTAS statements within your codebases.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.