CVE-2026-127119
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
51/100
Published: 2026-11-12
Modified: 2026-11-13
First seen: 2026-11-12
Status: active
Attack Surface
Network
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
None
A:
None
Description
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
Weakness Classification (2)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| AWS | aws-sdk-pandas | 1.1.0 < 3.18.0 |
| AWS | aws-sdk-pandas | 1.1.0 < 3.18.0 |
References & Advisories (3)
vendor-advisory
release-notes
patch
Change History
| Field | Old Value | New Value | Detected |
|---|---|---|---|
| cvss_base | 5.9 | 5.3 | 2026-11-13T15:30 |