CVE-2026-12283

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-12283

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12283.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-12283

Aliases

GHSA-43cr-4635-mfjp

Published

2026-07-17T19:05:04Z

Modified

2026-08-12T03:51:36Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

SQL injection in Amazon Athena Synapse connector

Details

Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax.

Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name.

To remediate this issue, users should upgrade to version v2026.21.1 or later.

Database specific

{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12283.json"
}

References

Affected packages

Git / github.com/awslabs/aws-athena-query-federation

Affected ranges

Type

GIT

Repo

https://github.com/awslabs/aws-athena-query-federation

Events

Introduced

4106cb65647f8632558bdb9ce9f105dc1db7480e

Fixed

62ae8d579420d8d0e3068fcd8b12b9fb810495e9

Fixed

60a52b0e25c9a60d1932fe188f09750eec8c6cf9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "v2022.20.1"
        },
        {
            "fixed": "v2026.19.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v2022.*

v2022.20.1

v2022.22.1

v2022.23.1

v2022.24.1

v2022.30.1

v2022.30.2

v2022.32.1

v2022.38.1

v2022.39.1

v2022.42.1

v2022.42.2

v2022.46.1

v2022.47.1

v2025.*

v2025.34.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12283.json"