CVE-2026-127119
Awaiting Analysis Awaiting Analysis - Queue

EMR Log Path Exposure in AWS SDK for pandas

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: AMZN

Description
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127119
EUVD
EUVD-2026-124642

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AWS aws-sdk-pandas From 1.1.0 (inc) to 3.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-341 A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
CWE-283 The product does not properly verify that a critical resource is owned by the proper entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the EMR module in AWS SDK for pandas (awswrangler) versions 1.1.0 to 3.17.x. When creating an EMR cluster without an explicit log location, the library uses a predictable default S3 bucket name for storing cluster logs without verifying ownership. A remote attacker who creates the bucket first can then access the cluster's logs, including job step output.

Detection Guidance

To detect this vulnerability, check if your AWS SDK for pandas (awswrangler) version is between 1.1.0 and 3.17.x. Run: pip show awswrangler to verify the installed version. If the version is vulnerable, upgrade to 3.18.0 or later.

Impact Analysis

This vulnerability could allow unauthorized individuals to read sensitive Amazon EMR cluster logs, including job step output, if they pre-create the default S3 bucket. This may lead to exposure of confidential data, operational details, or sensitive information processed by the EMR cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data access controls and protection of personal or health information.

Mitigation Strategies

Upgrade to AWS SDK for pandas version 3.18.0 or later. If immediate upgrade is not possible, either pass an explicit log location or create the default EMR log bucket in your own account for each region used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...