CVE-2026-119301: 
Python vulnerability analysis and mitigation

CVE-2026-119301 is an SQL injection vulnerability caused by improper neutralization of quoting syntax in SQL identifier construction within the Apache Iceberg write component of AWS SDK for pandas (also published as awswrangler). It affects versions 3.5.2 through 3.17.0 of the library. The vulnerability was disclosed on November 2, 2026, with a fix released in version 3.17.1 on August 3, 2026. It carries a CVSS v3.1 base score of 7.9 (High) (GitHub Advisory, AWS Bulletin).

The root cause is improper neutralization of quoting syntax (CWE-149) and SQL injection (CWE-89) in the to_iceberg() function, where table and column identifiers — including column names read from the AWS Glue Data Catalog during schema reconciliation — are spliced directly into generated Amazon Athena SQL without escaping the identifier delimiter. An attacker who controls AWS Glue Data Catalog metadata can craft a malicious column name that breaks out of the SQL identifier context, injecting arbitrary SQL commands. The fix, implemented in PR #3423, properly escapes identifiers in Iceberg SQL generation (GitHub Advisory, Release 3.17.1).

A successful exploit allows an authenticated attacker with glue:UpdateTable or related permissions on a shared database to read any table accessible to a more privileged principal invoking to_iceberg(), and to write arbitrary data to the table that privileged principal is updating. This results in high confidentiality and integrity impact with a scope change — data belonging to other, more privileged users or services can be exfiltrated or tampered with. Availability impact is rated low, and no direct system-level code execution is implied (GitHub Advisory, AWS Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be an authenticated user with specific AWS Glue Data Catalog metadata modification permissions, and also requires a more privileged principal to invoke to_iceberg() on the same table — making automated exploitation unlikely (GitHub Advisory, AWS Bulletin).

1. Reconnaissance: Identify an environment where AWS SDK for pandas (awswrangler) versions 3.5.2–3.17.0 is in use and where a more privileged principal regularly calls to_iceberg() to write to an Apache Iceberg table backed by AWS Glue Data Catalog.
2. Gain metadata modification access: Obtain or abuse an AWS IAM identity with glue:UpdateTable or equivalent permissions on the shared Glue Data Catalog database containing the target table.
3. Craft malicious column name: Modify the AWS Glue Data Catalog schema for the target table to introduce a column name containing SQL injection payload — e.g., a name like col" || (SELECT ...) -- — that breaks out of the SQL identifier quoting context used by to_iceberg().
4. Trigger victim execution: Wait for or induce the more privileged principal to invoke to_iceberg() on the affected table. The library reads column names from the Glue Data Catalog during schema reconciliation and splices them unsanitized into Athena SQL.
5. Achieve unauthorized read/write: The injected SQL executes in the context of the privileged principal's Athena session, allowing the attacker to read data from tables accessible to that principal and/or write arbitrary records to the table being updated (GitHub Advisory, AWS Bulletin).

• AWS Glue Data Catalog: Column names in table schemas containing unusual characters such as quotation marks ("), SQL keywords (SELECT, UNION, --), or other SQL syntax that would not appear in legitimate column names.
• Amazon Athena Logs: Athena query history showing unexpected or malformed SQL queries generated during to_iceberg() operations, particularly queries referencing tables not normally accessed by the invoking principal.
• AWS CloudTrail: UpdateTable API calls to AWS Glue from unexpected IAM principals or at unusual times, especially modifying column definitions on Iceberg tables.
• Application Logs: Errors or anomalous behavior in awswrangler/aws-sdk-pandas logs during Iceberg write operations, potentially indicating SQL parse failures or unexpected query results (GitHub Advisory, AWS Bulletin).

Upgrade AWS SDK for pandas (awswrangler) to version 3.17.1 or later, which properly escapes identifiers in Iceberg SQL generation (Release 3.17.1, AWS Bulletin). There is no complete workaround for earlier versions; however, AWS recommends two interim mitigations: (1) avoid calling to_iceberg() with a principal that has more privileges than the principals who can modify that table's Glue Data Catalog metadata, and (2) restrict glue:UpdateTable and related permissions on shared databases to only authorized users. Any forked or derivative code incorporating the affected component should also be patched.

The vulnerability was discovered by George Chen and disclosed through AWS's coordinated vulnerability disclosure process, with AWS Security publishing an official bulletin (2026-161-AWS) on November 2, 2026 (AWS Bulletin). The issue was noted on security-focused social media accounts including posts on Mastodon and infosec.exchange shortly after disclosure. Red Hat tracked the issue via Bugzilla (Bug 2565298), classifying it as high severity for the awswrangler package (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregators was observed.