AWS discloses four flaws in pandas SDK, MCP server and dev tools

AWS discloses four flaws in pandas SDK, MCP server and dev tools

2 November 2026: AWS published four security bulletins rated Important on 2 November, covering open-source tools that run in customers' own accounts rather than AWS-managed services: AWS SDK for pandas, the AWS Serverless MCP Server, Amazon Virtual Engineering Workbench and the aidlc-traceability command-line tool. AWS reports no exploitation in any of them.

Not yet independently verified. AWS reports no exploitation in any of the four bulletins. We have not checked the GitHub advisories behind them beyond the identifiers AWS gives. We will update this when it can be confirmed, and remove this note.

Two of the fixes shipped months before the bulletins, so the news for most teams is the disclosure itself and the check it prompts; the other two need action now.

The four flaws and their fixes

Bulletin	CVE	Tool	Flaw	Fix
2026-161-AWS	CVE-2026-119301	AWS SDK for pandas (awswrangler) 3.5.2 to before 3.17.1	Quoting in Apache Iceberg SQL identifiers	3.17.1, released 3 August 2026
2026-162-AWS	CVE-2026-119085	Virtual Engineering Workbench, all commits before c146486	Template engine injection in the publishing component	Redeploy from the latest main branch
2026-163-AWS	CVE-2026-120497	aidlc-traceability CLI, 0.1.0 to before commit 96cf0ea	Stored cross-site scripting in HTML reports	Commit 96cf0ea of 3 July 2026, or remove
2026-164-AWS	CVE-2026-116635	AWS Serverless MCP Server before v0.2.1	Path traversal in the deployment status component	v0.2.1

Which ones reach the most data

The pandas SDK flaw is the subtle one. A user who can only change a table's metadata in the AWS Glue Data Catalog can craft a column name that makes to_iceberg(), run by a more privileged principal, read any table that principal can reach and write to the table it updates. AWS says there is no complete workaround: upgrade, avoid running to_iceberg() as a principal more privileged than those who can edit the table's Glue metadata, and restrict glue:UpdateTable.

The Virtual Engineering Workbench flaw is the widest. An authenticated user who submits a crafted CloudFormation template through the product versioning API can run code with the permissions of the publishing Lambda function's role, which reaches data and resources across all tenant projects. The fix is in pull request 31, merged on 4 May, so any deployment not redeployed since then is exposed; until it is, limit who can create or update product versions. AWS credits Trung Nguyen of CyStack.

The MCP server and the retired CLI

In the Serverless MCP Server, anyone who can influence the agent driving it can pass traversal sequences or an absolute path as a project name and read JSON files outside the intended directory, or create and overwrite them where write access is on. There is no workaround; upgrade to v0.2.1. AWS credits Syed Anas Mohiuddin.

The aidlc-traceability CLI was removed from the awslabs/aidlc-workflows repository on 16 July and is no longer maintained there; a re-implementation lives in aws-samples/sample-aidlc-traceability. Copies obtained before 3 July should be removed or updated, and AWS suggests using Markdown output instead of HTML.

Sources

• AWS Security Bulletin 2026-161-AWS: CVE-2026-119301, AWS SDK for pandas, 2 November 2026
• AWS Security Bulletin 2026-162-AWS: CVE-2026-119085, Virtual Engineering Workbench, 2 November 2026
• AWS Security Bulletin 2026-163-AWS: CVE-2026-120497, aidlc-traceability, 2 November 2026
• AWS Security Bulletin 2026-164-AWS: CVE-2026-116635, AWS Serverless MCP Server, 2 November 2026