Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-118029medium5.9

Unverified ownership of the default Athena query result location in AWS SDK for pandas

Impact

AWS SDK for pandas (awswrangler) before 3.16.1 may allow remote actors to read and tamper with Athena query results via a pre-created S3 bucket due to unverified ownership of the default query result location. The weakness is CWE-283 Unverified ownership. Users should upgrade to version 3.16.1 or later.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

aws · AMZN

aws-sdk-pandas

1 range
AMZN version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → before 3.16.1

custom versions

unaffected

unknown

Other versions: unaffected

Original source description

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. 

To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-118029

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-283 ↗

CWE-283 Unverified ownership

AMZN

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

AMZN · platform conditions

Any condition may hold

Any condition may hold

Vulnerable product

cpe:2.3:a:aws:aws-sdk-pandas:*:*:*:*:*:*:*:*

From (inclusive): 0

Before: 3.16.1

Original applicability statements
[
  {
    "operator": "OR",
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:aws:aws-sdk-pandas:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "0",
            "versionEndExcluding": "3.16.1"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
AMZN

Assigning organization

2026-10-28

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

2 sources
github.com/aws/aws-sdk-pandas/releases/tag/3.16.1
release-notesAMZN
aws.amazon.com/security/security-bulletins/2026-153-aws/
vendor-advisoryAMZN