CVE-2026-35561
Published: 03 April 2026
Summary
CVE-2026-35561 is a high-severity Missing Authorization (CWE-862) vulnerability in Amazon Athena Odbc. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the vulnerable Amazon Athena ODBC driver to version 2.1.0.0.
Protects against session hijacking in browser-based authentication flows by enforcing mechanisms to ensure session authenticity.
Strengthens authenticator management to address insufficient protections in the browser-based authentication components of the ODBC driver.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability description explicitly mentions enabling session interception or hijacking in browser-based authentication flows, directly mapping to the Browser Session Hijacking technique.
NVD Description
Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows. To remediate this issue,…
more
users should upgrade to version 2.1.0.0.
Deeper analysisAI
CVE-2026-35561 is a vulnerability involving insufficient authentication security controls in the browser-based authentication components of the Amazon Athena ODBC driver versions prior to 2.1.0.0. This flaw stems from inadequate protections in the browser-based authentication flows, which could enable session interception or hijacking, as classified under CWE-862 (Missing Authorization). The issue affects users of the affected ODBC driver on supported platforms including Linux, macOS Intel, and macOS ARM.
A remote attacker with no privileges (PR:N) could potentially exploit this vulnerability over the network (AV:N), though it requires high attack complexity (AC:H) and does not involve user interaction (UI:N). Successful exploitation would grant high confidentiality (C:H) and integrity (I:H) impacts with no availability disruption (A:N) and unchanged scope (S:U), resulting in a CVSS v3.1 base score of 7.4. Attackers could intercept or hijack authentication sessions during the browser-based flows, potentially gaining unauthorized access to Athena resources.
The AWS security bulletin (2026-013) and Athena ODBC driver release notes recommend upgrading to version 2.1.0.0 to remediate the issue. Patch downloads are available for Linux RPM, macOS Intel PKG, and macOS ARM PKG from the official Athena driver repository.
Details
- CWE(s)