CVE-2026-118029: Unverified ownership of the default Athena query result location in AWS SDK for pandas
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS SDK for pandas (awswrangler)to a version that resolves this vulnerability.Fixed in 3.16.1 - Configuration
Set an explicit Athena query result location or enforce a workgroup result configuration.
Athena query result location = explicit result location or enforced workgroup result configuration - Compensating control
Verify that the default Athena result bucket in each account and region is owned by your own account.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
AWS SDK for pandas installations before 3.16.1 are exposed when Athena uses a default query-result S3 bucket whose ownership has not been verified. Exposure depends on the account and region because the default Athena result bucket should be checked in each account and region.
What would an attacker need to exploit this?
An attacker would need to have pre-created the S3 bucket used as the default Athena query result location. This could allow them to read query results and tamper with result sets returned to the caller.
Is user interaction required?
Yes. The supplied vector identifies user interaction as required, and exploitation has high attack complexity with no privileges required.
What can be done if an immediate upgrade is not possible?
Verify that the default Athena result bucket is owned by your account in every relevant account and region. Set an explicit query result location or enforce an Athena workgroup result configuration.
How can I remediate the issue?
Upgrade AWS SDK for pandas (awswrangler) to version 3.16.1 or later. Also verify bucket ownership and avoid relying on an unverified default result location.