Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVE-2026-112408
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112408
Amazon SageMaker Python SDK
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "AWS",
"product": "Amazon SageMaker Python SDK",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.257.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.0.0",
"lessThan": "3.10.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-112408
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #49420 · Revision 1
- Added to Heist Feed
- Publisher date