CVE-2026-119301

Name of the Vulnerable Software and Affected Versions AWS SDK for pandas (awswrangler) versions 3.5.2 through 3.17.0

Description Improper neutralization of quoting syntax in SQL identifier construction within the Apache Iceberg write component allows an authenticated remote user with permissions to modify AWS Glue Data Catalog metadata to perform unauthorized actions. By using a crafted column name, the user can read any table accessible to a more privileged principal and write to the table that the privileged principal is updating.

Recommendations Upgrade to version 3.17.1 or later.