CVE-2026-118029

    Dashboard / Vulnerabilities / CVE-2026-118029

    CVE-2026-118029

    Published: 28 Oct 2026Last Modified: 8 Nov 2026

    Summary: Unverified ownership of the default Athena query result location in AWS SDK for pandas

    Details: Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.  To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.

    References: https://aws.amazon.com/security/security-bulletins/2026-153-aws/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118029.json, https://nvd.nist.gov/vuln/detail/CVE-2026-118029, https://github.com/aws/aws-sdk-pandas/releases/tag/3.16.1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5f26a71674977808db7e7fc2c2d3578db79c1a5a

    Affected versions

    3.12.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118029 | CVE-DB