---
id: "GHSA-3rgm-255m-m9g5"
page: "https://infrastack.ai/live/GHSA-3rgm-255m-m9g5"
kind: "vulnerability"
aliases: ["GHSA-3rgm-255m-m9g5"]
title: "CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "awswrangler", "data-pipelines", "emr", "lab-disclosure", "package", "python"]
not_affected_if: ["emr-module-unused", "explicit-log-location", "version-3.18.0-or-later"]
published_at: null
first_seen_at: "2026-11-12T20:27:08+00:00"
updated_at: "2026-11-12T20:29:10+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/2026-181-aws/", "first_seen_at": "2026-11-12T20:27:08+00:00"}]
exploit_sources: []
---

# CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

Link for people: https://infrastack.ai/live/GHSA-3rgm-255m-m9g5 (this .md is for agents)

When a cluster is created without an explicit log location, awswrangler writes logs to a predictable default S3 bucket without checking the caller owns it. A remote actor who creates that bucket first can read cluster logs, including job step output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show awswrangler`, or look at the version pinned in your lock file.
- Search your EMR cluster creation code for calls that do not pass an explicit log location (`log_uri`).
- Confirm whether the default bucket `aws-logs-{account}-{region}` exists in your account in each region you use.

## Fix

- Upgrade awswrangler to `3.18.0` or later (affected: `>= 1.1.0` and `< 3.18.0`).
- Grant the caller `s3:ListBucket` on the default log bucket, which version 3.18.0 requires to verify ownership.
- Until upgraded, pass an explicit log location pointing to a bucket you own.

## Timeline

- 2026-11-12T20:27:08+00:00 lab https://aws.amazon.com/security/security-bulletins/2026-181-aws/ — AWS: CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

## Documents

- [advisory] AWS: CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas https://aws.amazon.com/security/security-bulletins/2026-181-aws/

## From the sources

CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

### CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

Bulletin ID: 2026-181-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/12/2026 10:45 PM PST Last Updated Date: 11/12/2026 12:15 PM PST

 Description:

AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS services, including Amazon EMR.

We identified CVE-2026-127119, an issue in the EMR module of AWS SDK for pandas (awswrangler) from version 1.1.0 before 3.18.0. When a cluster is created without an explicit log location, the library uses a predictable default S3 bucket name for the cluster logs without verifying that the caller's account owns that bucket. A remote actor who creates that bucket first could read the cluster's logs, including job step output. 

Impacted versions: >= 1.1.0 AND < 3.18.0

Resolution:

This issue has been addressed in awswrangler version 3.18.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users who rely on the default log location should also make sure the caller has s3:ListBucket on the default log bucket, which version 3.18.0 requires to verify bucket ownership.

Workarounds:

If you cannot upgrade immediately, pass an explicit log location that points to a bucket you own when creating clusters with AWS SDK for pandas, or create the default EMR log bucket (aws-logs-{account}-{region}) in your own account in each region you use. If that bucket name is already taken by another account, treat it as untrusted and use an explicit log location.

References:

- CVE-2026-127119
- GHSA-3rgm-255m-m9g5

Acknowledgement:

We would like to thank Upwind Security for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_