To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AWS | aws-sdk-pandas | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 12 Nov 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use. | |
| Title | Unverified ownership of the default EMR cluster log location in AWS SDK for pandas | |
| First Time appeared |
Aws
Aws aws-sdk-pandas |
|
| Weaknesses | CWE-283 CWE-341 |
|
| CPEs | cpe:2.3:a:aws:aws-sdk-pandas:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Aws
Aws aws-sdk-pandas |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-11-12T18:49:21.317Z
Reserved: 2026-11-12T15:23:43.752Z
Link: CVE-2026-127119
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-12T19:17:03.430
Modified: 2026-11-12T19:24:37.847
Link: CVE-2026-127119
Redhat
No data.
OpenCVE Enrichment
No data.