CVE-2026-118029 in AWS SDK for pandas
Summary
by MITRE • 10/28/2026
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within AWS SDK for pandas, commonly known as awswrangler, prior to version 3.16.1 centers on a critical misconfiguration in how the library handles default query result locations for Amazon Athena queries. This flaw stems from an unverified ownership check regarding the S3 bucket designated to store query outputs. When developers utilize the default configuration without explicitly specifying a secure destination or verifying the integrity of the underlying storage infrastructure, the SDK may inadvertently target buckets that are not owned by the executing AWS account. This behavior creates a significant security gap where remote actors who control these external S3 buckets can intercept sensitive data and manipulate the results returned to the application logic.
From a technical perspective, this issue represents an insecure default configuration combined with insufficient input validation regarding resource ownership. The library assumes that if no explicit result location is provided, it will safely write to a bucket associated with the current context or account. However, without rigorous verification of bucket policies and access control lists, the SDK fails to ensure exclusive access rights. Consequently, any entity possessing administrative privileges over an S3 bucket can configure their environment such that Athena queries directed at this default location are routed there instead of a secure, isolated storage area. This allows attackers to perform unauthorized data exfiltration by reading query results containing potentially sensitive information or engage in result tampering by modifying the output files before they are read back into the pandas DataFrame structure used by the application.
The operational impact of this vulnerability is severe, particularly for organizations processing large volumes of analytical data through Athena and integrating it directly with Python-based analytics pipelines using awswrangler. Attackers who exploit this flaw can achieve unauthorized access to structured query language outputs which may contain personally identifiable information, financial records, or proprietary business intelligence. Furthermore, the ability to tamper with result sets introduces a risk of data integrity compromise where downstream applications make decisions based on falsified metrics or corrupted datasets. This undermines trust in automated reporting systems and analytical models that rely on accurate Athena query outcomes for critical decision-making processes.
This vulnerability aligns closely with CWE-209, which describes the generation of an error message that includes sensitive information useful to attackers, although more accurately it maps to CWE-538 regarding insertion of sensitive data into log files or external storage without proper access controls and CWE-776 regarding improper restriction of recursive entity within a directory. In terms of offensive security frameworks, this scenario is consistent with the MITRE ATT&CK technique T1048, which covers Exfiltration Over Alternative Protocol, as well as T1539 for Steal Web Session Cookie if session data were involved, but primarily reflects lateral movement and data staging via cloud storage services. The exploitation vector relies on social engineering or prior compromise of AWS accounts to gain control over S3 buckets that are then leveraged against unsuspecting users of the awswrangler library.
To remediate this vulnerability effectively, organizations must upgrade their dependencies to version 3.16.1 or later where these ownership verification checks have been implemented and strengthened. Beyond software updates, architectural changes are necessary to enforce secure defaults across all AWS accounts and regions in use. It is imperative that teams verify the ownership of any default Athena result buckets ensuring they belong exclusively to the trusted account rather than shared or external entities. Additionally, developers should avoid relying on implicit default locations by explicitly setting a dedicated S3 bucket for query results within each script execution context. Implementing workgroup-level configurations in AWS Glue Data Catalog that enforce specific output paths provides an additional layer of policy-based enforcement that prevents queries from writing to unintended storage destinations. These measures collectively mitigate the risk of data leakage and manipulation associated with this cloud-native vulnerability.