Bug 2565298 (CVE-2026-119301) - CVE-2026-119301 awswrangler: awswrangler: Privilege escalation via crafted column name in Apache Iceberg write component
Summary: CVE-2026-119301 awswrangler: awswrangler: Privilege escalation via crafted co...
Keywords:
Status: NEW
Alias: CVE-2026-119301
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-02 17:25 UTC by OSIDB Bzimport
Modified: 2026-11-02 17:33 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-02 17:25:30 UTC 
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.



To remediate this issue, users should upgrade to version 3.17.1 or later.
Note You need to log in before you can comment on or make changes to this bug.