awswrangler CVE-2026-119301

Requires a shared AWS Glue Data Catalog in which the attacker is an authenticated principal holding glue:UpdateTable (or equivalent catalog-metadata modify) permission on a database/table that a victim processes, AND a separate, more-privileged principal that invokes awswrangler/aws-sdk-pandas to_iceberg() on that same table while running versions 3.5.2 through 3.17.0. Exploitation is limited by several factors: the attacker must already have catalog-write access, the privileged victim must actually run to_iceberg() against the poisoned table (required user interaction), and the deployment must pair a shared catalog with an over-privileged Iceberg writer - environments where catalog-metadata write and to_iceberg() privileges are held by the same trust level are not exposed. The advisory states there is no complete workaround short of upgrading; partial mitigations are to avoid calling to_iceberg() with a principal more privileged than those who can modify that table's Glue metadata and to restrict glue:UpdateTable and related permissions on shared databases.

This is a genuine but conditional privilege-escalation / data-exposure issue, not a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L, 7.9 High) tells a coherent story that matches the description: the attack is network-reachable but requires an already-authenticated principal (PR:L) who holds glue:UpdateTable/catalog-modify rights, succeeds only when a separate more-privileged principal independently runs to_iceberg() against the poisoned table (UI:R), and crosses a privilege boundary (S:C) to expose and corrupt that victim principal's data (C:H/I:H, A:L). The high attack complexity (AC:H) reflects the dependency on the victim's actions and specific shared-catalog conditions rather than any described timing or race - the trigger mechanics beyond 'crafted column name spliced into generated Athena SQL' are only loosely detailed in the sources. No EPSS score and no KEV listing were supplied, and there is no public exploit identified at time of analysis; the only references are the vendor advisory, the AWS security bulletin, and the patched release. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real-but-not-urgent priority: the preconditions (shared Glue Data Catalog, an over-privileged to_iceberg() caller, attacker already holding catalog-write permission) meaningfully constrain real-world exploitation. Signals are consistent rather than conflicting; the main missing data are EPSS and any exploitation telemetry.

In an environment with a shared AWS Glue Data Catalog, a lower-privileged but authenticated user who holds glue:UpdateTable on a shared database alters a table's metadata to introduce a maliciously crafted column name. When a separate, more-privileged pipeline or principal later calls awswrangler's to_iceberg() against that table, the unescaped identifier is spliced into generated Amazon Athena SQL, letting the attacker read any table that privileged principal can access and write to the table it is updating. No public proof-of-concept is referenced, and success depends on the victim principal performing the to_iceberg() operation.