CVE-2026-112408: Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Missing verification of source of a communication channel in the defaultbucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon SageMaker Python SDKto a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
Amazon SageMaker Python SDKto a version that resolves this vulnerability.Fixed in 2.257.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Amazon SageMaker Python SDK V3 before 3.10.0 or V2 before 2.257.3 are affected when they use the default_bucket() function. The issue concerns SageMaker execution environments that use an S3 bucket selected by that function.
What does an attacker need to exploit this vulnerability?
An attacker would need to pre-create a predictably named S3 bucket that the SDK selects through default_bucket(). Exploitation does not require privileges or user interaction according to the supplied vector, but the attack complexity is rated high.
What is the potential impact of successful exploitation?
A remote attacker may achieve code execution in the target SageMaker execution environment and obtain IAM credentials available to that environment. The reported impact includes high confidentiality, integrity, and availability effects.
How should affected users remediate the issue?
Upgrade the Amazon SageMaker Python SDK to version 3.10.0 or later for V3, or version 2.257.3 or later for V2.