CVE-2026-119301 – Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Bulletin ID: 2026-161-AWS
Publication Date: 11/02/2026 08:30 AM PST

Description:

We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.

Impacted versions: awswrangler >= 3.5.2, < 3.17.1

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Read the original article:

CVE-2026-119301 – Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas