early signals AWS security bulletins infra

CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

// AI summary

AWS SDK for pandas (awswrangler) has CVE-2026-118029 concerning unverified ownership of the default Athena query result location, affecting users integrating with Amazon Athena.

// from the source

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets retu
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins infra

    CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

    aws.amazon.com
  2. AWS security bulletins infra

    CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools

    aws.amazon.com
  4. AWS security bulletins infra

    CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)

    aws.amazon.com