CVE-2026-75910

This CVE exposes a deployment template that prioritized developer convenience over least-privilege by defaulting Secrets Manager access to wildcard scope. The vulnerability isn't a code flaw — it's a configuration failure: the IAM execution role attached to the Athena federated query connector was granted read access to all secrets in the account rather than being scoped to a specific prefix. The remediation that works for new deployments ('supply a non-empty SecretNamePrefix') tells you the security control was always present in the template — it simply wasn't enforced. For existing deployments, the fix is not automatic. If you use infrastructure-as-code and previously deployed this connector with default parameters, re-running your deployment pipeline with a patched template will NOT update your existing Lambda function. You must explicitly redeploy or override the parameter to terminate the vulnerable configuration. Lambda versioning keeps every old version invokable — dormant versions with the permissive role remain accessible unless explicitly removed. The blast radius extends beyond the CVE's scope. The Athena federated connector architecture means a compromised execution role can reach every data source that connector was configured to federate, not just Secrets Manager. The CVSS of 6.5 reflects a single technical path, but the operational impact of lateral movement through a federated query engine is substantially broader. The distribution problem compounds remediation. Deployment templates like this get embedded in CDK constructs, internal platform abstractions, and Partner Quick Starts. Organizations consuming these derivatives may never receive upstream fix notifications. The true number of affected deployments is unknowable because forked and copied templates exist in repositories disconnected from the CVE disclosure channel. Audit your existing deployments: check if any Lambda functions running the Athena federated connector have execution roles with broad Secrets Manager permissions. If they do, redeploy with an explicit SecretNamePrefix or rotate the IAM role to least-privilege scope. Enable CloudTrail logging on GetSecretValue calls to detect any misuse of the connector's secret access.

Reviewed through automated stages and approved by a human before publication.