CVE-2026-65321 in PyAthena
Summary
by MITRE • 08/02/2026
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability exists in PyAthena versions prior to 3.35.4 and represents a critical sql injection flaw that undermines the security of aws athena database connections. The vulnerability stems from improper quote-escaping implementation within the DefaultParameterFormatter.format() method, specifically affecting how DELETE and CTAS statements are processed. When these statements are executed, they route through the _escape_hive function which employs backslash-escaping for single quotes instead of the standard double-quote escaping mechanism. This deviation creates a fundamental security gap because both aws athena and trino systems do not interpret backslashes as escape characters within string literals, allowing malicious input to manipulate the sql parsing process.
The technical exploitation occurs when attacker-supplied input contains a single quote followed by sql syntax elements such as UNION SELECT or destructive commands. This specific pattern causes the sql parser to prematurely terminate string literals, effectively breaking the intended query structure and enabling unauthorized command execution. The vulnerability permits attackers to construct malicious queries that can exfiltrate data through UNION SELECT operations, execute destructive statements against database resources, and control both the destination and content of CTAS (create table as select) operations. This comprehensive attack surface allows for both information disclosure and potential data manipulation or deletion scenarios.
The operational impact of this vulnerability extends beyond simple data theft to include complete database compromise scenarios. Attackers can leverage this flaw to bypass authentication mechanisms entirely, as the vulnerability operates without requiring valid credentials due to its unauthenticated nature. The ability to control CTAS operations is particularly dangerous because it allows attackers to create tables in arbitrary locations with custom content, potentially leading to persistent backdoor installations or data corruption. Additionally, the vulnerability affects both DELETE and CTAS statements, providing attackers with multiple attack vectors for executing malicious operations against database resources.
Security mitigations for this vulnerability require immediate patching of PyAthena to version 3.35.4 or later where proper quote-escaping implementation has been corrected. Organizations should implement network-level restrictions to limit access to athena endpoints and monitor for unusual query patterns that might indicate exploitation attempts. The vulnerability aligns with CWE-89 sql injection weakness classification and maps to ATT&CK technique T1078 valid accounts and T1566 credential access through command and control channels. System administrators should also consider implementing query logging and monitoring solutions to detect anomalous sql patterns, particularly those involving UNION operations or unauthorized CTAS statements that could indicate exploitation attempts. Regular security assessments of database connection libraries and proper input validation practices remain essential for preventing similar vulnerabilities in other components of the data processing pipeline.
This vulnerability demonstrates the critical importance of proper parameter escaping in database interaction libraries and highlights how seemingly minor implementation details can create significant security risks. The flaw represents a classic case where database-specific escaping requirements were not properly implemented, leading to cross-platform compatibility issues that exposed the system to injection attacks. Organizations using aws athena or similar systems should conduct comprehensive audits of their database connection libraries to identify similar vulnerabilities and ensure all third-party components properly handle sql parameterization according to industry standards and best practices for database security.