CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
An authenticated user can execute injected read-only SQL queries via crafted table names in the Amazon Athena Synapse connector, exposing unintended data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12283?
CVE-2026-12283 is a medium-severity SQL injection vulnerability in aws-athena-query-federation, published on 17 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax.
Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name.
To remediate this issue, users should upgrade to version v2026.21.1 or later.
Weakness: CWE-89
Which versions are affected by CVE-2026-12283?
How do I fix CVE-2026-12283?
No fix has been published for CVE-2026-12283 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-12283 being exploited?
There is no known exploitation of CVE-2026-12283 in the wild and no public exploit code.
Sources
Also known as GHSA-43cr-4635-mfjp.