Vulnerabilities

Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow…

Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

AWS

Product

aws-sdk-pandas

CVSS v3.1

5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Fix

available

Weakness

CWE-283, CWE-341

Exposure class

Cloud platform, Developer platform

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-127119 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 40
   AWS bulletin AWS 5h ago

   CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

   CVE-2026-127119 Amazon Web Services