Amazon Athena, a serverless query service, allows SQL analysis of S3 data. Athena Query Federation extends this capability to external data sources like DynamoDB and Azure Synapse through open-source connectors. A critical vulnerability, CVE-2026-75910, was discovered in the ClickHouse connector deployment template. This flaw, present in versions prior to v2026.17.1, involves incorrect privilege assignment. An authenticated remote user could exploit this to read arbitrary AWS Secrets Manager secrets. The attack vector involves manipulating the connector's connection string to point to an unrelated secret. Simultaneously, the user would control a database endpoint. This manipulation would cause the ClickHouse connector to transmit the targeted secret to the user's controlled endpoint. Remediation requires updating the ClickHouse connector to version v2026.17.1 or later. This ensures the correct privilege assignments are in place. Further details are available in the linked AWS Security Bulletin.