Unauthorized Access in AWS SDK for Pandas EMR Module
CVE-2026-127119

5.9MEDIUM

Key Information:

Vendor

Aws

Status
Aws-sdk-pandas
Vendor
CVE Published:
12 November 2026

What is CVE-2026-127119?

The AWS SDK for Pandas prior to version 3.18.0 contains a vulnerability related to unverified ownership of the default cluster log location in its EMR module. This allows potential remote actors to gain access to sensitive Amazon EMR cluster logs, including important job step outputs, through a pre-created S3 bucket. To mitigate this risk, it is recommended that users upgrade to version 3.18.0 or later. For those unable to upgrade immediately, defining an explicit log location or creating the default EMR log bucket within their own account for each utilized region can help protect against unauthorized access.

Affected Version(s)

aws-sdk-pandas 1.1.0 < 3.18.0

References

https://github.com/aws/aws-sdk-pandas/releases/tag/3.18.0
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upwind Security
.