CVE-2026-119085 - Template injection in the publishing component of Virtual Engineering Workbench
CVE-2026-119085
Summary
Bulletin ID: 2026-161-AWS
Publication Date: 11/02/2026 08:30 AM PST
Description:
We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.
Impacted versions: awswrangler >= 3.5.2, < 3.17.1
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.