Unverified Ownership Vulnerability in AWS SDK for Pandas Affects Amazon Web Services
CVE-2026-118029

5.9MEDIUM

Key Information:

Vendor

Aws

Status
Aws-sdk-pandas
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118029?

The AWS SDK for pandas contains a vulnerability in the Athena module where unverified ownership of the default query result location could allow unauthorized remote actors to access and manipulate query results stored in a pre-created S3 bucket. This weakness highlights the importance of ensuring that the default result bucket in each account is owned by the proper user and encourages users to explicitly define result locations or configure workgroup result settings to enhance security. Users are advised to update to version 3.16.1 or later to mitigate this risk.

Affected Version(s)

aws-sdk-pandas 0 < 3.16.1

References

https://github.com/aws/aws-sdk-pandas/releases/tag/3.16.1
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.