CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
Sdk For ยท 2026-10-28
Actions
Technical Details
| Affected Versions | < 3.16.1 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-118029 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update AWS SDK for pandas to version 3.16.1 to address the security vulnerability (CVE-2026-118029) and ensure that the default Athena result bucket is owned by your account to prevent unauthorized access to query results.
For Platform Teams
Integrate the latest version of AWS SDK for pandas (3.16.1) into your data processing pipelines to enhance security and maintain data integrity for Athena query results.
For Executives
Implement the security patch for AWS SDK for pandas to mitigate the risk of unauthorized access to Athena query results and ensure data integrity, thereby protecting sensitive information and maintaining customer trust.
Source
Related Sdk For Updates
- CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2 (2026-10-25)
- CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++ (2026-10-21)
- CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (2026-10-14)
- CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (2026-09-29)
- Introducing SDK Client Warm-Up feature in the AWS SDK for Java 2.x (2026-09-25)