CVE-2026-127119
Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
| CWE | CWE-283 CWE-341 |
| Vendor | aws |
| Product | aws-sdk-pandas |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for aws aws-sdk-pandas
Be the first to know when new medium vulnerabilities affecting aws aws-sdk-pandas are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
AWS / aws-sdk-pandas
1.1.0 < 3.18.0
References
Credits
Upwind Security