CVE-2026-127119: Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.
To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS SDK for pandas (awswrangler)to a version that resolves this vulnerability.Fixed in 3.18.0 - Configuration
Pass an explicit log location instead of relying on the default EMR cluster log location.
EMR module log location = explicit log location - Compensating control
Create the default EMR log bucket in your own AWS account in each region used.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of AWS SDK for pandas versions from 1.1.0 before 3.18.0 are exposed when using the EMR module's default cluster log location. The risk applies where the default EMR log bucket has not been created and controlled by the user's own account in a region they use.
What must an attacker do to access logs?
An attacker must pre-create the S3 bucket used as the default EMR cluster log location. This could allow them to read cluster logs, including job step output.
What can be done if an immediate upgrade is not possible?
Pass an explicit EMR log location, or create the default EMR log bucket in your own AWS account for every region you use. These measures prevent reliance on an unverified default bucket location.
How can I determine whether my environment may be affected?
Check whether your AWS SDK for pandas version is earlier than 3.18.0 and whether EMR jobs use the default log location rather than an explicitly configured location. Also verify that the default EMR log bucket is owned by your account in each AWS region where you run EMR.