CVE-2026-118029 in Amazon and Aws Products
Published on October 28, 2026
Unverified ownership of the default Athena query result location in AWS SDK for pandas
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
Vulnerability Analysis
CVE-2026-118029 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
ACTIVE
Weakness Type
Unverified Ownership
The software does not properly verify that a critical resource is owned by the proper entity.
Products Associated with CVE-2026-118029
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Aws Sdk Pandas. Just hit a watch button to start following.