awswrangler <3.18 EMR default log S3 read info disclosure
CVE-2026-127119 Published on November 12, 2026
Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
Vulnerability Analysis
CVE-2026-127119 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Types
Unverified Ownership
The software does not properly verify that a critical resource is owned by the proper entity.
Predictable from Observable State
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
Products Associated with CVE-2026-127119
stack.watch emails you whenever new vulnerabilities are published in Aws Sdk Pandas or Amazon Aws. Just hit a watch button to start following.
