High severity · published Oct 21, 2026
CVE-2026-112408
Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
New
8.1
CVSS
0.7%
EPSS
No
On KEV
Description
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Amazon SageMaker Python SDK · AWS
before 2.257.3; 3.0.0 before 3.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112408
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112408
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-142-aws/
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.3
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.10.0
github.com
https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-5rx8-8fr2-f855
pypi.org
https://pypi.org/project/sagemaker/2.257.3/
pypi.org
https://pypi.org/project/sagemaker/3.10.0/
More from Amazon SageMaker Python SDK
7.2
CVE-2026-8597
Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK
7.2
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path