CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry
CVE-2026-125926
Summary
Bulletin ID: 2026-181-AWS
Publication Date: 11/12/2026 13:00 PM PST
Description:
We identified CVE-2026-127119, an issue in the EMR module of AWS SDK for pandas (awswrangler) from version 1.1.0 before 3.18.0.
When a cluster is created without an explicit log location, the library uses a predictable default S3 bucket name for the cluster logs without verifying that the caller's account owns that bucket. A remote actor who creates that bucket first could read the cluster's logs, including job step output.
Impacted versions: >= 1.1.0 AND < 3.18.0
Refer to the article for the most up-to-date and complete information.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.