Advisoriesby IbisAWSAWS-2026-161
Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in...
No fix yet
Bulletin ID: 2026-161-AWS Publication Date: 11/02/2026 08:30 AM PST Description: We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. Impacted versions: awswrangler >= 3.5.2, < 3.17.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to High
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- Severity from
- NVD
More AWS advisories
All AWS
Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetImproper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yetStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yetTemplate injection in the publishing component of Virtual Engineering WorkbenchCVE-2026-119085no fix yetLinux kernel IPv4 TCP use-after-free IssueCVE-2026-98432no fix yetInsertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yet