MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-127119
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.002
- Cvss severity
- MEDIUM
- Cvss score
- 5.3
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 5.3
- Cvss version
- 3.1
- Cve id
- CVE-2026-127119
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-12T19:59:23+00:00
- Name
- CVE-2026-127119
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Published at
- 2026-11-12T19:17:03.430
- Last modified
- 2026-11-13T15:17:44.310
- Epss percentile
- 0.09929
Related Entities (2)
HAS_WEAKNESS (2)
Related research
Explore deeper with Ninja Signal's threat intelligence graph