Critical SQL Injection Found in PyAthena

PyAthena versions prior to 3.35.4 contain a critical SQL injection vulnerability identified as CVE-2026-65321. This flaw carries a CVSS 3.1 score of 9.8, indicating a maximum severity level that allows unauthenticated remote attackers to bypass security controls.

What's at Risk

The vulnerability exists within the DefaultParameterFormatter.format() method of the PyAthena library. Organizations utilizing this library to interface with Athena or Trino services are potentially at risk if their applications process untrusted input through these affected functions. Any system where an application exposes database connectivity to external users or processes unvalidated data is a prime target for this type of exploitation.

How the Flaw Works

SQL injection occurs when an application fails to properly sanitize user-supplied data before including it in a database query. In general terms, this class of vulnerability allows an attacker to manipulate the structure of the underlying SQL statement. By injecting specific syntax, an attacker can trick the database into executing unintended commands. This typically enables unauthorized parties to exfiltrate sensitive data, modify existing records, or execute administrative commands that the application was never intended to support. Because the database engine cannot distinguish between legitimate developer-written code and attacker-injected input, the malicious instructions are executed with the permissions of the application itself.

How to Protect Your Systems

• Upgrade PyAthena to version 3.35.4 or later immediately to resolve the improper quote-escaping logic.
• Audit application code that utilizes PyAthena to ensure that user input is not directly concatenated into database queries.
• Implement the principle of least privilege by ensuring the database service account has only the minimum permissions necessary for its intended function.
• Monitor database logs for unusual query patterns, such as unexpected UNION SELECT statements or unauthorized DELETE commands.
• Restrict network access to database interfaces to ensure they are not exposed to the public internet.

Given the critical severity of CVE-2026-65321 and the potential for full data exfiltration or destructive command execution, prompt remediation is necessary. Applying the provided patch is the only effective way to neutralize the specific flaw in the formatting logic, preventing attackers from leveraging this path to gain unauthorized control over database operations.