Skip to content
CVE Tracker
Back

CVE-2026-119301

Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Medium5.0
Published
Updated
Reserved
Assigned by
AMZN

Description

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

Scores

CVSS scores of CVE-2026-119301, by who scored it
Scored byCVSSScoreVector
AMZNCNA (assigner)4.0Medium5.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
AMZNCNA (assigner)3.1High7.9CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
NVDNVD · Awaiting Analysis4.0Medium5.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

Affected products

  • AWS · aws-sdk-pandas

    • affected 3.5.2 – < 3.17.1

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .