---
id: "GHSA-g8fh-6w6x-mhqf"
kind: "vulnerability"
aliases: ["GHSA-g8fh-6w6x-mhqf"]
title: "CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["athena", "aws", "aws-glue", "iceberg", "lab-disclosure", "package", "python"]
not_affected_if: ["no-to-iceberg-usage", "single-principal-access", "version-3.17.1-or-later"]
published_at: null
first_seen_at: "2026-11-02T17:02:21+00:00"
updated_at: "2026-11-02T17:03:43+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/", "first_seen_at": "2026-11-02T17:02:21+00:00"}]
---

# CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

AWS SDK for pandas (awswrangler) builds SQL identifiers unsafely in its Apache Iceberg write path, so a crafted column name can break out of quoting. An authenticated user who can edit AWS Glue Data Catalog metadata can thereby read tables that a more privileged principal can access and write to the table that principal is updating.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show awswrangler`; affected versions are `>= 3.5.2` and `< 3.17.1`.
- Look for scripts or jobs that call `to_iceberg()` and check which IAM principal runs them.
- Review who holds `glue:UpdateTable` and related permissions on shared Glue databases.

## Fix

- AWS SDK for pandas (awswrangler): upgrade to `3.17.1` or later.
- Forked or derivative code: apply the same fixes.

## Timeline

- 2026-11-02T17:02:21+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/ — AWS: CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

## Documents

- [mentions] AWS: CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas https://aws.amazon.com/security/security-bulletins/rss/2026-161-aws/

## From the sources

CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

### CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Bulletin ID: 2026-161-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 08:30 AM PST

Description:

AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.

Impacted versions: awswrangler >= 3.5.2, < 3.17.1

Resolution:

This issue has been addressed in AWS SDK for pandas version 3.17.1, released August 3, 2026. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no complete workaround for earlier versions. Until you upgrade, avoid calling to_iceberg() with a principal that has more privileges than the principals who can modify that table's AWS Glue Data Catalog metadata, and restrict glue:UpdateTable and related permissions on shared databases.

References:

- CVE-2026-119301
- GHSA-g8fh-6w6x-mhqf

Acknowledgement:

We would like to thank George Chen for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_