AWS SDK for pandas EMR Log Exposure Vulnerability (CVE-2026-127119)

AWS SDK for pandas (awswrangler) versions 1.1.0 through 3.17.x have a nasty security flaw: when creating EMR clusters without specifying a log location, the library defaults to a predictable S3 bucket name without checking ownership. An attacker could snag that bucket first and read your cluster logs and job outputs. **Action required:** upgrade to version 3.18.0 or later immediately if you're using affected versions.