CVE-2026-118029
Description
A flaw was found in AWS SDK for pandas (awswrangler). The Athena module does not verify the ownership of the default query result location in Amazon Simple Storage Service (S3). A remote attacker who pre-creates the default S3 storage bucket can exploit this vulnerability to read sensitive Athena query results and tamper with data returned to the user.
Statement
This vulnerability is rated as Moderate for Red Hat environments using the AWS SDK for pandas (awswrangler) because successful exploitation requires an attacker to pre-create and control the predictable default Amazon S3 bucket name before legitimate usage occurs. Environments that enforce explicit S3 output destinations or Athena workgroup query result settings are not exposed to this flaw. In affected configurations, an attacker can read or alter Athena query outputs returned to the client, but cannot directly compromise underlying host environments or credential stores.
Mitigation
Verify that the default Athena result bucket in each account and Region is owned by your own account, and set an explicit result location or enforce a workgroup result configuration.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
An attacker could gain unauthorized access to system resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
