Loading vulnerability…
Athena result-bucket ownership verification failure in AWS SDK for pandas
CVE-2026-118029 affects the Athena module in AWS SDK for pandas (awswrangler) before version 3.16.1. When no applicable workgroup output location or explicit s3_output is configured, _get_s3_output() falls back to create_athena_bucket(), which constructs a predictable S3 bucket name from the caller's AWS account ID and region. The bucket-creation handler treats BucketAlreadyExists and BucketAlreadyOwnedByYou identically, accepting an existing bucket without verifying ownership. An attacker who pre-creates the expected bucket and grants the victim access can receive Athena query results. Missing integrity validation in the CREATE TABLE AS SELECT (CTAS) result-consumption flow also permits manifest tampering that redirects the caller to attacker-modified result data.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of Athena query output and the integrity of result sets returned to applications. Exposed output can include sensitive personal, financial, credential, or business data present in queried datasets. CTAS manifest manipulation can cause attacker-modified Parquet data to be loaded into the caller's DataFrame, potentially corrupting downstream analytics and application decisions. Repeated use of the attacker-owned result location can expose successive query results. No direct availability impact or arbitrary code execution is established for this vulnerability.
If you can’t patch tonight, do this now.
Avoid the vulnerable default-bucket fallback by explicitly configuring s3_output to a bucket owned by the intended account, or by configuring a trusted Athena workgroup ResultConfiguration with EnforceWorkGroupConfiguration enabled. Check default-bucket ownership using HeadBucket with ExpectedBucketOwner. Where default buckets are required, create them in the legitimate account before first SDK use. Restrict workload access to untrusted external S3 buckets where operationally feasible.
Patch, then assume compromise.
Upgrade AWS SDK for pandas to version 3.16.1 or later, preferably the latest supported release. Version 3.16.1 adds expected-bucket-owner verification during bucket creation and integrity validation for CTAS manifests. Incorporate these fixes into forked or derivative implementations. Verify ownership of default Athena result buckets in every account and region, and configure an explicit trusted result location or enforce a trusted workgroup result configuration.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.