CVE-2026-65321: PyAthena SQL Injection Flaw
TL;DR - PyAthena versions before 3.35.4 contain a critical SQL injection flaw. - Apps using vulnerable parameter formatting with DELETE or CTAS are at risk. - Upgrade to 3.35.4 immediately and review logs for quote-breaking payloads.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-65321 |
| CVSS score | 9.8 Critical |
| Attack vector | Network |
| Auth required | None, according to NVD description of unauthenticated attacker-controlled input reaching vulnerable formatting |
| Patch available | Yes, fixed in PyAthena 3.35.4 |
CVE-2026-65321 is a critical SQL injection vulnerability in PyAthena, the Python DB API 2.0 client for Amazon Athena. According to NVD, the issue affects PyAthena versions prior to 3.35.4 and stems from improper quote escaping in DefaultParameterFormatter.format().
The practical risk is straightforward: if an application passes attacker-controlled input into vulnerable PyAthena query formatting paths, especially for DELETE and CREATE TABLE ... AS SELECT (CTAS) operations, the input can break out of the intended string literal and alter the SQL sent to Athena or Trino-compatible backends. Patch availability is confirmed, and defenders should treat this as an urgent library upgrade and application review item.
What Is This Vulnerability?
At its core, this is a quote-escaping failure that becomes a SQL injection issue because PyAthena selected the wrong escaping routine for certain statement types. Older logic in DefaultParameterFormatter.format() used a Presto/Trino-safe escaper for some statements but routed other statements, including DELETE and CTAS, into a Hive-oriented escaping path.
That matters because the Hive escaper used backslash escaping for single quotes, converting ' into \'. In Athena and Trino string literals, backslashes are not treated as escape characters in the way this logic assumed. As a result, an attacker-supplied single quote is still capable of terminating the string literal, after which injected SQL syntax can be interpreted as part of the statement.
NVD explicitly calls out several consequences: data exfiltration using UNION SELECT, execution of destructive statements, and attacker control over CTAS destination and content. The fix commit also makes clear that this was not only a statement routing bug but a parser-assumption mismatch: PyAthena applied Hive-style escaping in contexts parsed by Athena/Trino, where single quotes must be doubled instead.
Technical Notes
The vulnerable condition can be understood with a simple example. Safe escaping for Athena/Trino should transform this hostile input:
a' OR 1=1 --
into:
'a'' OR 1=1 --'
The vulnerable logic instead produced a backslash-escaped form:
'a\' OR 1=1 --'
Because Athena/Trino do not treat the backslash as a valid string-literal escape here, the quote can terminate the string early and the trailing OR 1=1 -- can alter query behavior.
The remediation in the project fix includes selecting the Trino-safe escaper by default, limiting Hive escaping to positively identified Hive DDL cases, stripping leading SQL comments before statement detection, and explicitly avoiding the bad routing for CTAS statements.
Who Is Affected?
The affected product is PyAthena. The verified affected version range is all versions prior to 3.35.4, and the fixed version is 3.35.4. If your environment uses PyAthena==3.35.3 or any earlier release, it should be considered vulnerable unless you have independently verified a backported fix in a private fork.
This issue is especially relevant for application owners who use PyAthena as part of a web application, API backend, internal analytics workflow, or automation pipeline where user-supplied data is inserted into SQL operations through the library’s parameter formatting path. Risk is highest where code performs DELETE or CTAS queries, since the primary-source analysis specifically identifies these statement classes as vulnerable routing cases.
Defenders should not assume this is only a direct internet exposure problem. Even if Athena access is only available behind an internal service, any untrusted input source, such as form fields, API parameters, uploaded metadata, or multi-tenant workflow inputs, may be enough to trigger exploitation if that data reaches the vulnerable formatter.
Technical Notes
You can quickly check installed versions with common Python tooling:
python -m pip show PyAthena
python -m pip list | grep -i pyathena
If you use Poetry or Pipenv, inspect lockfiles for vulnerable versions:
grep -i pyathena poetry.lock Pipfile.lock requirements*.txt
CVSS Score Breakdown
NVD rates CVE-2026-65321 at 9.8 Critical. The specific vector string was not exposed in the provided research note, so it is important not to invent the exact component sequence. Still, a 9.8 score generally reflects a combination of remote reachability, no required privileges, no required user interaction, and high impact across confidentiality, integrity, and availability.
That aligns with the published behavior of this bug. If attacker-controlled input can reach vulnerable formatting in an application-facing path, the resulting SQL injection can permit data extraction, unauthorized query manipulation, and destructive operations. NVD’s description explicitly supports confidentiality impact through UNION SELECT exfiltration and integrity impact through tampering or destructive statements. Availability impact is also plausible if destructive or resource-intensive operations are executed, though defenders should rely on NVD’s final score rather than over-interpret beyond the published text.
The key point for practitioners is that the score is not merely theoretical. This is not a low-severity parser oddity or a hard-to-reach local flaw. It is a critical library-layer SQL injection in a commonly used Python client component. Even if your application only exposes a narrow set of query patterns, the existence of a vulnerable formatting path should trigger immediate patching and code review.
Technical Notes
Where the vector string is unavailable from your source set, document it as unknown rather than filling gaps from memory:
CVSS base score: 9.8 (Critical)
CVSS vector: not provided in the available NVD payload referenced by this research set
Defender assumption: treat as remotely reachable and high impact until verified otherwise
Exploitation Status
As of the provided research date, there is no confirmed evidence in the source set that CVE-2026-65321 is being actively exploited in the wild. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, which is one useful signal that widespread confirmed exploitation has not been established at this time.
There is also no separately confirmed standalone public proof-of-concept repository in the supplied primary references. However, defenders should not mistake the absence of a polished PoC repository for low exploitability. The fix commit includes regression tests using a hostile payload string that effectively demonstrates the vulnerable condition and the corrected behavior. For many defenders, that is enough for internal validation and detection engineering.
So the verified status is: no confirmed in-the-wild exploitation from the cited sources, no KEV listing, and no independently confirmed public weaponized PoC repository in the supplied material. In the absence of stronger telemetry, security teams should assume exploitability is practical because the root cause and triggering input pattern are both clearly documented.
Technical Notes
The patch-related hostile payload referenced in the fix logic is:
HOSTILE = "a' OR 1=1 --"
That is not proof of active exploitation, but it is a concrete exploitability indicator and a useful seed for detection and safe validation in a test environment.
How to Detect It
Detection should focus on three areas: vulnerable asset inventory, application behavior, and suspicious query content. Start by identifying all Python services that import or depend on PyAthena and verify whether any are pinned below 3.35.4. Then determine whether those applications issue DELETE or CTAS statements with parameterized user input. If they do, they warrant urgent investigation.
At the logging layer, look for SQL statements sent to Athena that contain broken-string patterns, suspicious inline comments, or exfiltration syntax appended after a quote. Patterns such as a single quote followed by OR, UNION SELECT, or -- inside parameters are strong signals. Since Athena query logging visibility varies by environment, defenders may need to inspect application logs, SQL debug logging, CloudTrail-related telemetry for Athena query activity, or any custom audit pipelines that preserve final rendered statements.
You should also review code for wrappers or forks around PyAthena formatting behavior. Even after upgrading, locally copied formatter code or monkey patches could preserve the flawed escaping logic. If full rendered SQL is not logged, look for application errors tied to malformed DELETE or CTAS statements and correlate them with suspicious user inputs.
Technical Notes
Example grep pattern for application logs that may contain suspicious SQL injection artifacts:
grep -E "UNION[[:space:]]+SELECT|OR[[:space:]]+1=1|--|CREATE[[:space:]]+TABLE.*AS[[:space:]]+SELECT|DELETE[[:space:]]+FROM" /var/log/app/*.log
Example Splunk-style query for suspicious rendered query text:
index=app_logs ("PyAthena" OR "Athena")
("UNION SELECT" OR "OR 1=1" OR "--" OR "CREATE TABLE" OR "DELETE FROM")
| stats count by host, source, query_text
Example Sigma-like detection idea for SQL strings in app logs:
title: Suspicious PyAthena Query Patterns
logsource:
product: application
detection:
selection:
message|contains:
- "UNION SELECT"
- "OR 1=1"
- "--"
- "DELETE FROM"
- "CREATE TABLE"
condition: selection
level: medium
If you can instrument outbound SQL before execution, a practical heuristic is to flag DELETE or CTAS statements containing user-controlled values with unmatched quoting or comment markers.
Mitigation and Patching
The primary mitigation is to upgrade PyAthena to version 3.35.4. That is the fixed version identified by NVD, PyPI metadata, and the project release track. If you maintain Python environments through containers, virtual environments, CI images, or serverless deployment bundles, update all build paths, not just live hosts. This type of issue often persists because old lockfiles or base images continue to reinstall the vulnerable release.
If an immediate upgrade is not possible, the fallback is risk reduction rather than a complete fix. Limit or temporarily disable application features that generate DELETE and CTAS statements from untrusted input. Review code paths that rely on PyAthena parameter formatting and enforce strict input validation where possible. However, these workarounds are not equivalent to patching because the flaw lives in the library’s quote handling logic.
After upgrading, regression-test any workflows using DELETE, CTAS, comments before statements, or unusual whitespace handling. The fix includes changes to statement detection and comment stripping, so organizations should validate query behavior in production-like staging. Also review forks or vendored copies of DefaultParameterFormatter to ensure they were not left behind.
Technical Notes
Upgrade with pip:
python -m pip install --upgrade "PyAthena==3.35.4"
If you use a requirements file, pin the fixed release:
PyAthena==3.35.4
Then reinstall dependencies:
python -m pip install -r requirements.txt
For Poetry:
poetry add PyAthena@3.35.4
For Pipenv:
pipenv install PyAthena==3.35.4
Short-term workaround guidance if you cannot patch immediately:
1. Disable or restrict DELETE and CTAS features exposed to untrusted users.
2. Reject input containing single quotes, inline comments, or SQL metacharacters where business logic allows.
3. Add server-side allowlists for expected parameter formats.
4. Audit for custom copies of DefaultParameterFormatter and remove vulnerable logic.
Because workarounds are incomplete, defenders should assume exposure remains until 3.35.4 is deployed everywhere PyAthena is used.
References
The authoritative technical sources for this CVE are the NVD entry, the project advisory, the fix commit, and package release metadata. Together, they establish the affected range, root cause, and fixed version without requiring speculation. For incident response or internal risk memos, these are the sources worth citing directly.
The most useful source for technical validation is the fix commit, because it explains the vulnerable statement routing, the escaping mismatch, and the exact hardening changes introduced. The PyPI and release pages confirm that 3.35.4 is the version organizations should target for remediation.
Technical Notes
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-65321
- GitHub Security Advisory: https://github.com/laughingman7743/PyAthena/security/advisories/GHSA-xwj5-g6cv-4r5c
- Fix commit: https://github.com/pyathena-dev/PyAthena/commit/27901d12245ea722b3b4e211c60e2ade4e7c8efd
- Project repository: https://github.com/pyathena-dev/PyAthena
- PyPI package: https://pypi.org/project/PyAthena/
- PyPI JSON metadata: https://pypi.org/pypi/PyAthena/json
- Releases: https://github.com/pyathena-dev/PyAthena/releases
In practical terms, CVE-2026-65321 should be treated as a high-priority dependency vulnerability. If your software uses PyAthena and handles any untrusted input in Athena-bound queries, verify versioning immediately, upgrade to 3.35.4, and review logs for quote-breaking payloads and suspicious DELETE or CTAS activity.
For further insights on related vulnerabilities, you can explore our articles on CVE-2026-16221 and Phishing Awareness.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.