CVE-2026-127119

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-127119
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127119.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-127119
Aliases
  • GHSA-3rgm-255m-m9g5
Published
2026-11-12T18:49:21Z
Modified
2026-11-14T02:47:32Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
Details

Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.

To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-283",
        "CWE-341"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127119.json"
}
References

Affected packages

Git / github.com/aws/aws-sdk-pandas

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-sdk-pandas
Events
Introduced
7f63dd8c01ea4ae3b3259600a4ae2d3e016c46db
Fixed
8f865a82f9ae07af22a5545939f724c004a8b69d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.1.0"
                },
                {
                    "fixed": "3.18.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "3.18.0",
            "range": [
                {
                    "fixed": "8f865a82f9ae07af22a5545939f724c004a8b69d"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "1.1.0"
                },
                {
                    "fixed": "3.18.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

1.*
1.1.0
1.1.1
1.10.0
1.10.1
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
2.*
2.0.0
2.0.1
2.1.0
2.10.0
2.11.0
2.12.0
2.12.1
2.13.0
2.14.0
2.15.0
2.15.1
2.16.0
2.16.1
2.17.0
2.18.0
2.19.0
2.2.0
2.20.1
2.3.0
2.4.0
2.4.0-docs
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.1.0
3.1.1
3.11.0
3.12.1
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.6.0
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127119.json"