CVE-2026-118029Medium· 5.9▾ SunlitUnverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller vi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
aws-sdk-pandas < 3.16.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87913Medium· 5.9A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state…
CVE-2026-87912Medium· 5.9Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops
CVE-2026-119115High· 8.5Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
CVE-2026-115413High· 7.8AWS API MCP Server OAuth Token Audience Validation Bypass
CVE-2026-115418High· 7.3SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
CVE-2026-115845Medium· 6.4Incomplete validation in the run_script Python sandbox in AWS MCP Server