SQL Injection Vulnerability in AWS SDK for Pandas by Amazon
CVE-2026-119301

5MEDIUM

Key Information:

Vendor

Aws

Status
Aws-sdk-pandas
Vendor
CVE Published:
2 November 2026

What is CVE-2026-119301?

The AWS SDK for Pandas, specifically within the Apache Iceberg write component, is susceptible to an SQL injection vulnerability. This allows an authenticated remote user with the ability to modify AWS Glue Data Catalog metadata to exploit improperly sanitized identifiers. By leveraging crafted column names, a user can gain unauthorized access to data tables accessible to a more privileged user. This vulnerability underscores the necessity for an immediate update to version 3.17.1 or later to safeguard against unauthorized data manipulation and access.

Affected Version(s)

aws-sdk-pandas 3.5.2 < 3.17.1

References

https://github.com/aws/aws-sdk-pandas/security/advisories...
third-party-advisory
https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.