LOWVulnerability
Global

CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

·Source: AWS Security Bulletins

Updated:

Executive Summary

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the At

Analysis

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. Impacted versions: awswrangler Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Indicators of Compromise (3)

CVE (1)
CVE-2026-118029
NVDMITRE CVE
URL (1)
https://aws.amazon.com/security/security-bulletins/2026-153-aws/
VirusTotalURLhaus
Domain (1)
aws.amazon.com
VirusTotalURLhaus
Source Attribution

Originally published by AWS Security Bulletins on Oct 28, 2026.

Related Threats

MEDIUMVulnerabilityNEW

DHS Strikes Back, Targeting 'Icepick' Leaks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trump-administration-strikes-back-targeting-icepick-leaks-image_small-5-a-33249.jpg" align=right hspace=4><b>Icepi.cx Is Down But Icepicx.is Is Live</b><br>

Bank Info Security
MEDIUMVulnerabilityNEW

CISO Problems That Can't Be Solved With Technology

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ciso-problems-that-cant-be-solved-technology-image_small-4-a-33248.jpg" align=right hspace=4><b>Operational Struggles and Arrogant Vendors Mean Tool Churn Is Likely to Continue</b><br>No matter how advanced or powerful cybersecurity tools become, they will never be able to fix many of the key problems that confront cyber defenders

Bank Info Security
CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619
Unit 42 (Palo Alto)