CVE-2026-65321: PyAthena SQL Injection via Improper Quote Escaping

Overview

CVE-2026-65321 is a critical SQL injection vulnerability in PyAthena, the popular Python DB API 2.0 client for Amazon Athena. Assigned a CVSS score of 9.8 (Critical), the flaw allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping logic in the library's default parameter formatter.

The vulnerability is patched in PyAthena 3.35.4. All prior versions are affected.

Technical Details

The root cause lies in DefaultParameterFormatter.format(), which routes DELETE and CTAS (Create Table As Select) statements to a private method called _escape_hive. This method backslash-escapes single quotes using a naive string replacement — a pattern that is insufficient for Athena's Hive-style SQL dialect.

An attacker can craft parameter values containing sequences that survive the backslash-escaping step and break out of the intended string context, injecting arbitrary SQL clauses.

Proof of Concept (Conceptual)

# Vulnerable: attacker-controlled value breaks out of string context
cursor.execute(
    "SELECT * FROM my_table WHERE id = %(id)s",
    {"id": "1'; DROP TABLE my_table; --"}
)
# _escape_hive fails to neutralize the payload in DELETE/CTAS paths

Attack Vector

• Vector: Network
• Authentication Required: None (unauthenticated)
• Complexity: Low
• Impact: High — arbitrary SQL execution against the caller's Athena environment

Because PyAthena connects to AWS Athena, successful exploitation can result in unauthorized data exfiltration, data destruction via DROP/DELETE statements, or creation of attacker-controlled tables in AWS S3-backed datasets.

Affected Versions

Remediation

Upgrade PyAthena to 3.35.4 or later immediately.

# Upgrade via pip
pip install --upgrade pyathena
 
# Verify installed version
pip show pyathena | grep Version
 
# Or with uv
uv pip install "pyathena>=3.35.4"

Additional Hardening

1. Avoid raw string interpolation for Athena queries — always use parameterized queries.
2. Restrict Athena IAM permissions to the minimum required (avoid DROP, DELETE grants for application roles).
3. Audit query logs in AWS CloudTrail for unexpected DROP or DELETE statements.

References

• NVD Advisory: CVE-2026-65321
• PyAthena on PyPI
• PyAthena GitHub Repository