Vulnerability · Published Nov 2, 2026 · Assigned by AMZN

CVE-2026-119301Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

High 7.9

In plain English

A high-severity SQL injection in aws-sdk-pandas from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.9High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

Affected products (as reported)

Vendor	Product	Versions
AWS	aws-sdk-pandas	3.5.2 – before 3.17.1

Weakness: CWE-149, CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

References

https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-g8fh-6w6x-mhqf third-party-advisory
https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1 release-notes, patch
https://aws.amazon.com/security/security-bulletins/2026-161-aws/ vendor-advisory