Answer in brief
CVE-2026-12283 records a Medium severity (CVSS 6.8) vulnerability in SQL injection in Amazon Athena Synapse connector. The current sources do not mark it as known exploited. The current feed maps AWS/aws-athena-query-federation (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AWS/aws-athena-query-federation (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AWS/aws-athena-query-federationgeneric | v2022.20.1 | Not reported |
Published upstream
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name. To remediate this issue, users should upgrade to version v2026.21.1 or later.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-12283 records a Medium severity (CVSS 6.8) vulnerability in SQL injection in Amazon Athena Synapse connector. The current sources do not mark it as known exploited. The current feed maps AWS/aws-athena-query-federation (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AWS/aws-athena-query-federation (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AWS/aws-athena-query-federationgeneric | v2022.20.1 | Not reported |
Published upstream
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name. To remediate this issue, users should upgrade to version v2026.21.1 or later.
Quoted source text, attributed separately from HOL analysis.