CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
CVE-2026-115413
Summary
Bulletin ID: 2026-153-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/28/2026 08:30 AM PDT
Description:
AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.
Impacted versions: awswrangler < 3.16.1
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.