{"id":"CVE-2026-119301","kind":"vulnerability","aliases":["CVE-2026-119301"],"related":[],"title":"Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in…","description":"CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas\n\n### CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas\n\nBulletin ID: 2026-161-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 08:30 AM PST\n\nDescription:\n\nAWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.\n\nImpacted versions: awswrangler >= 3.5.2, < 3.17.1\n\nResolution:\n\nThis issue has been addressed in AWS SDK for pandas version 3.17.1, released August 3, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no complete workaround for earlier versions. Until you upgrade, avoid calling to_iceberg() with a principal that has more privileges than the principals who can modify that table's AWS Glue Data Catalog metadata, and restrict glue:UpdateTable and related permissions on shared databases.\n\nReferences:\n\n- CVE-2026-119301\n- GHSA-g8fh-6w6x-mhqf\n\nAcknowledgement:\n\nWe would like to thank George Chen for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS SDK for pandas (awswrangler) has an SQL identifier flaw in its Apache Iceberg write path, where a crafted column name is not properly quoted. An authenticated user who can modify AWS Glue Data Catalog metadata can read tables that a more privileged principal can access and write to the table that principal is updating.","severity":"high","cvss":7.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["athena","aws","data-engineering","glue","iceberg","lab-disclosure","package","python"],"not_affected_if":["managed-hosting","no-to-iceberg-calls","single-privilege-principal"],"how_to_check":"- Check the installed version of the library with `pip show awswrangler` and compare it with the impacted range `>= 3.5.2, < 3.17.1`.\n- Look for calls to `to_iceberg()` in your code and note which AWS principal runs them.\n- Review who holds `glue:UpdateTable` and related permissions on shared Glue databases.","fix":"- AWS SDK for pandas (awswrangler): upgrade to `3.17.1` or later.\n- Any forked or derivative code: patch to incorporate the new fixes, as the bulletin recommends.","status":"open","published_at":"2026-11-02T17:17:39+00:00","first_seen_at":"2026-11-02T17:02:21+00:00","triaged_at":"2026-11-02T17:03:43+00:00","updated_at":"2026-11-02T17:36:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T17:03:43Z","model":"claude-haiku-5-5","output":{"fix":"- AWS SDK for pandas (awswrangler): upgrade to `3.17.1` or later.\n- Any forked or derivative code: patch to incorporate the new fixes, as the bulletin recommends.","reach":"network","title":"AWS SDK for pandas: crafted column name lets user read other Glue tables","impact":"medium","summary":"AWS SDK for pandas (awswrangler) has an SQL identifier flaw in its Apache Iceberg write path, where a crafted column name is not properly quoted. An authenticated user who can modify AWS Glue Data Catalog metadata can read tables that a more privileged principal can access and write to the table that principal is updating.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","aws","glue","athena","iceberg","data-engineering"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged user reads tables of a more privileged principal","analyst_note":"","how_to_check":"- Check the installed version of the library with `pip show awswrangler` and compare it with the impacted range `>= 3.5.2, < 3.17.1`.\n- Look for calls to `to_iceberg()` in your code and note which AWS principal runs them.\n- Review who holds `glue:UpdateTable` and related permissions on shared Glue databases.","plain_action":"","needs_analyst":false,"not_affected_if":["no-to-iceberg-calls","single-privilege-principal","managed-hosting"],"who_is_affected":"Teams that use awswrangler's to_iceberg() write path against AWS Glue Data Catalog tables, where users with different privilege levels share the catalog. The exposure depends on a low-privileged principal being able to modify Glue table metadata that a higher-privileged principal later writes to. Teams not using to_iceberg() or not running a mixed-privilege Glue setup can deprioritise it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000825,"input_tokens":4780,"output_tokens":694,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119301':18A,21A,91C,110C,181C,331C '-161':130C '-2026':17A,20A,90C,109C,180C,330C '08':142C '11/02/2026':141C '2026':129C,259C '3':258C '3.17.1':242C,255C '3.5.2':241C '30':143C '6w6x':335C 'access':79B,223C 'acknowledg':337C 'address':248C 'allow':199C 'amazon':168C,170C 'apach':12A,46B,98C,117C,184C 'athena':22B,169C 'attent':138C 'august':257C 'authent':60B,201C 'avoid':293C 'aw':23B,34B,65B,104C,123C,131C,133C,147C,163C,173C,207C,250C,313C 'awar':177C 'aws-security@amazon.com':358C 'awswrangl':38B,151C,240C 'bulletin':127C 'call':294C 'catalog':68B,210C,316C 'chen':344C 'code':273C 'collabor':346C 'column':53B,236C 'complet':285C 'compon':15A,187C 'concern':364C 'construct':9A,197C 'content':134C 'coordin':352C 'could':198C 'craft':52B,235C 'cve':16A,19A,89C,108C,179C,329C 'data':25B,67B,164C,209C,315C 'data-engin':24B 'databas':327C 'date':140C 'deriv':272C 'descript':146C 'disclosur':31B,354C 'earlier':288C 'email':357C 'engin':26B 'ensur':268C 'fix':280C 'flaw':43B 'fork':270C 'g8fh':334C 'generat':102C,121C 'georg':343C 'ghsa':333C 'ghsa-g8fh-6w6x-mhqf':332C 'glue':27B,66B,174C,208C,314C,320C 'iceberg':13A,28B,47B,99C,118C,185C,296C 'id':128C 'identifi':8A,42B,101C,120C,196C 'impact':238C 'import':136C 'improp':1A,92C,111C,189C 'incorpor':277C 'integr':160C 'issu':245C,349C 'lab':30B 'lab-disclosur':29B 'latest':265C 'librari':158C 'like':340C 'metadata':69B,211C,317C 'mhqf':336C 'modifi':64B,206C,309C 'name':54B,237C 'neutral':2A,93C,112C,190C 'new':279C 'open':155C 'open-sourc':154C 'packag':32B 'panda':37B,107C,126C,150C,161C,253C 'patch':275C 'path':49B 'permiss':204C,324C 'pleas':356C 'princip':77B,86B,221C,230C,299C,306C 'privileg':76B,220C,303C 'process':355C 'proper':57B 'pst':145C 'public':139C 'python':33B,157C 'question':362C 'quot':4A,58B,95C,114C,192C 'read':71B,213C 'recommend':261C 'refer':328C 'relat':323C 'releas':256C 'requir':137C 'resolut':243C 'restrict':319C 's3':171C 'scope':132C 'sdk':35B,105C,124C,148C,251C 'secur':361C 'separ':218C 'servic':165C 'share':326C 'sourc':156C 'sql':7A,41B,100C,119C,195C 'syntax':5A,96C,115C,193C 'tabl':72B,84B,215C,228C,311C 'thank':342C 'type':135C 'updat':88B,232C 'updatet':321C 'upgrad':262C,292C 'user':61B,202C 'version':239C,254C,266C,289C 'via':233C 'vulner':353C 'workaround':281C,286C 'would':339C 'write':14A,48B,81B,186C,225C","nicknames":[],"mitigations":[],"who_affected":"Teams that use awswrangler's to_iceberg() write path against AWS Glue Data Catalog tables, where users with different privilege levels share the catalog. The exposure depends on a low-privileged principal being able to modify Glue table metadata that a higher-privileged principal later writes to. Teams not using to_iceberg() or not running a mixed-privilege Glue setup can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["athena","aws","dataengineering","glue","high","iceberg","labdisclosure","package","python"],"first_public_at":"2026-11-02T16:35:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/#CVE-2026-119301","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T17:02:21+00:00","fetched_at":"2026-11-02T17:02:21+00:00","note":"AWS: CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas"},{"source":"nvd","external_id":"CVE-2026-119301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119301","severity":null,"published_at":"2026-11-02T17:17:39+00:00","modified_at":"2026-11-02T17:17:39+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null}],"documents":[{"id":52972,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/","title":"AWS: CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas\n\n### CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas\n\nBulletin ID: 2026-161-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 08:30 AM PST\n\nDescription:\n\nAWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.\n\nImpacted versions: awswrangler >= 3.5.2, < 3.17.1\n\nResolution:\n\nThis issue has been addressed in AWS SDK for pandas version 3.17.1, released August 3, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no complete workaround for earlier versions. Until you upgrade, avoid calling to_iceberg() with a principal that has more privileges than the principals who can modify that table's AWS Glue Data Catalog metadata, and restrict glue:UpdateTable and related permissions on shared databases.\n\nReferences:\n\n- CVE-2026-119301\n- GHSA-g8fh-6w6x-mhqf\n\nAcknowledgement:\n\nWe would like to thank George Chen for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-02T16:40:57+00:00","relation":"mentions","confidence":null,"note":null},{"id":53010,"url":"https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":53011,"url":"https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-g8fh-6w6x-mhqf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T16:35:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}