CVE-2026-119301High· 7.9▾ TwilightImproper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 43.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.
To remediate this issue, users should upgrade to version 3.17.1 or later.
aws-sdk-pandas >= 3.5.2 < 3.17.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118029Medium· 5.9Unverified ownership of the default Athena query result location in AWS SDK for pandas
CVE-2026-115418High· 7.3SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
CVE-2026-119084High· 8.1Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
CVE-2026-119922High· 8.8Babelfish for PostgreSQL Privilege Escalation
CVE-2026-121652Medium· 5.4Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
CVE-2026-119085High· 8.8Template injection in the publishing component of awslabs Virtual Engineering Workbench