CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. Impacted versions: awswrangler Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services
- Product
- AWS services, Python / PyPI packages
- Exposure class
- Cloud platform, Developer platform
Why it ranks 27 (Notable)
- Product class: cloud platform, developer platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-118029 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.