Amazon Web Services officially published a security bulletin addressing a privilege assignment vulnerability tracked as CVE-2026-75910 within the Athena Federated Query ClickHouse connector deployment template. Publicly disclosed on August 20, 2026, and identified under Bulletin ID 2026-084-AWS, the advisory highlights an important risk profile requiring prompt administrative remediation.
Understanding Athena Query Federation and the ClickHouse Connector
Amazon Athena operates as a serverless, interactive query service designed to enable data analysis directly inside Amazon Simple Storage Service using standard SQL syntax. To extend analytical capabilities, Athena Query Federation allows organizations to connect disparate data environments—including DynamoDB, Azure Synapse, and custom integrations—using standard SQL expressions. These connectors are built as open-source projects and deployed to the Athena service.
However, the security advisory points out that versions of the ClickHouse connector deployment template released prior to v2026.17.1 suffer from an incorrect privilege assignment flaw. This structural oversight opens a security vector where authenticated remote users can potentially read sensitive data residing within the deploying AWS account.
Vulnerability Mechanics and Potential Impact
The security mechanism exploited under CVE-2026-75910 involves manipulating connection parameters during query operations. Specifically, an authenticated remote user can target arbitrary secrets stored in AWS Secrets Manager within the deploying account. By configuring the connector’s connection string to point toward an unrelated secret alongside a database endpoint under direct user control, the connector unintentionally transmits the target secret straight to the attacker-controlled endpoint.
Key technical takeaways regarding the scope and vulnerability parameters include:
- Bulletin ID: 2026-084-AWS
- Affected Scope: Amazon Web Services (AWS) Athena Query Federation
- Vulnerability Type: Incorrect Privilege Assignment
- Impacted Software Versions: Connector deployments prior to v2026.17.1
- Associated CVE: CVE-2026-75910
Mitigation and Required Action
Cloud administrators and database engineers utilizing the Athena Federated Query ClickHouse connector must review their current deployment versions immediately. Because versions older than v2026.17.1 contain the flaw, upgrading to the patched release is essential to eliminate unauthorized secret transmission vectors. Organizations should consult official AWS security advisories for step-by-step update instructions.
Source: Original Article
