CVE-2026-118029

The record

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.  To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.

Affected packages

Related vulnerabilities

• CVE-2026-112911 filelock is a platform-independent file lock for Python. CWE-283
• CVE-2026-83791 Improper authorization in Windows Virtual Input allows an authorized attacker to elevate… CWE-283
• CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before… CWE-283
• CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-283
• CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component of the… CWE-283
• CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed… CWE-283
• CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox… CWE-283
• CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research… CWE-283