CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Bulletin ID: 2026-161-AWS Publication Date: 11/02/2026 08:30 AM PST Description: We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. Impacted versions: awswrangler >= 3.5.2, Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Apache Software Foundation
- Product
- Other Apache projects, AWS services, Python / PyPI packages
- Exposure class
- Web platform, Cloud platform, Developer platform
Why it ranks 34 (Notable)
- Product class: web platform, cloud platform
- Widely deployed vendor product (Amazon Web Services)
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-119301 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.