Bug 2562931 (CVE-2026-118029) - CVE-2026-118029 awswrangler: awswrangler: Information disclosure via unverified query result bucket ownership
Summary: CVE-2026-118029 awswrangler: awswrangler: Information disclosure via unverifi...
Keywords:
Status: NEW
Alias: CVE-2026-118029
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-28 15:43 UTC by OSIDB Bzimport
Modified: 2026-10-30 13:28 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-28 15:43:29 UTC 
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. 



To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
Note You need to log in before you can comment on or make changes to this bug.