CVE-2026-35561 is an authentication weakness in the browser-based sign-in of the Amazon Athena ODBC driver, scored 7.4 (High) in the CVE record. A threat actor might intercept or hijack authentication sessions. AWS says to upgrade to version 2.1.0.0, and it lists no workaround for the issue.
What's affected
- Product: Amazon Athena ODBC driver, on Windows, Linux and macOS
- Affected versions: before 2.1.0.0
- Fixed version: 2.1.0.0
- AWS bulletin: 2026-013-AWS, published 3 April 2026, content type Important
The bulletin covers six CVEs in the driver. CVE-2026-5485 is Linux only and was fixed in 2.0.5.1. The other five, CVE-2026-35558 through CVE-2026-35562, were fixed in 2.1.0.0 and apply to all supported platforms. AWS states that no workaround is available. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Find where the driver is installed and which version it is. On Windows, open the ODBC Data Source Administrator and look at the Drivers tab. On Linux, query the package manager:
rpm -qa | grep -i athena
On macOS, check the installed package receipts or the driver files. Any version older than 2.1.0.0 needs the update. Remember that BI tools and containers can bundle their own copy of the driver, so check those too.
What to do now
- Download and install Athena ODBC driver 2.1.0.0 or later for your platform from the links in the AWS bulletin.
- Find bundled or forked copies of the driver in BI tools, images and scripts, and update them.
- AWS says no workaround exists, so the update is the only fix for the sign-in weakness.
- If you use browser-based sign-in for Athena, review recent sign-in activity for sessions you do not recognise.
- Record the driver version in your software inventory.
Why it matters
The record files this under CWE-862, missing authorization, and describes insufficient protections in the browser-based authentication flows. AWS does not publish more detail, which is normal for a bulletin. The vector shows a network attack with high complexity, so exploitation is not simple.
Drivers are easy to forget. They get installed once on a laptop or in a base image and are never touched again. A driver that handles sign-in deserves a place in the inventory with a version next to it.
Quick check
Is there a workaround?
AWS states that no workaround is available. Upgrade to 2.1.0.0.
Are the other five CVEs fixed in the same version?
AWS says CVE-2026-35558 to CVE-2026-35562 were fixed in 2.1.0.0, and CVE-2026-5485 was fixed on Linux in 2.0.5.1.
Sources
Last reviewed: 19 October 2026.
