AWSAWS-2026-153

Unverified ownership of the default Athena query result location in AWS SDK for pandas

CVE-2026-118029 · Published Oct 28, 2026

Medium5.9

No fix yet

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. Impacted versions: awswrangler < 3.16.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 29Severity: Unrated to Medium

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Severity from: NVD

More AWS advisories

All AWS

Critical 9.8Oct 28

Native Brotli Decoder Remote Code Execution and Memory DisclosureCVE-2026-111497no fix yet Medium 6.5Oct 28

Secret masking bypass in the environment tool in Strands Agents ToolsCVE-2026-115415no fix yet High 7.3Oct 26

SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)CVE-2026-115418no fix yet Medium 5.9Oct 25

Denial of service in the event stream header decoder in AWS SDK for Go v2CVE-2026-89090no fix yet Medium 5.9Oct 25

XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePluginCVE-2026-18061no fix yet Critical 9.9Oct 25

Server-side request forgery in the Session Manager port forwarding functionality in AWS...CVE-2026-89049no fix yet