CVE-2026-110248 in SageMaker Python SDK
Summary
by MITRE • 10/15/2026
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the Amazon SageMaker Python SDK involves a critical flaw in how sensitive authentication data is handled during version control operations, specifically within the git_utils.py component affecting versions prior to V3 3.10.0 and V2 2.257.3. This issue manifests as an improper handling of credentials that results in their exposure through system logs when a Git clone operation encounters an error. The core technical deficiency lies within the runclone_command() function, which executes external processes to interact with remote repositories. When this subprocess fails, it generates standard error output containing detailed diagnostic information. In many cases, particularly during authentication failures or network issues involving private repositories, these error messages inadvertently include plaintext credentials such as usernames and passwords embedded in URLs used for cloning. Because the SDK does not implement redaction mechanisms before logging this output to CloudWatch Logs, any user with access to those logs can retrieve sensitive authentication material directly from the console interface or via API calls to CloudWatch.
This vulnerability aligns closely with CWE-532, which is defined as the insertion of sensitive information into log files for security purposes. The operational impact is severe because it allows an authenticated remote user who has permissions to view specific logs in Amazon CloudWatch to extract plaintext repository credentials. This exposure compromises the confidentiality and integrity of source code repositories that may contain proprietary intellectual property or critical infrastructure configurations. Furthermore, if these credentials are reused across other services due to poor password hygiene practices by developers, the attacker could potentially gain unauthorized access to additional systems within the organization's cloud environment. The attack vector is classified under ATT&CK technique T1505.003, which involves Server Log Data Discovery, as it relies on accessing stored log data rather than active exploitation of a service vulnerability during runtime execution.
The risk is exacerbated by the fact that CloudWatch Logs are often centralized for monitoring and debugging purposes across multiple teams within an organization. Without proper access controls or log filtering rules in place at the AWS account level, any IAM user with read permissions on the relevant log groups can exploit this flaw. This creates a significant compliance concern for organizations subject to regulations such as PCI DSS, HIPAA, or SOC 2, which mandate strict control over sensitive data exposure and require robust logging practices that do not inadvertently leak secrets. The lack of automatic redaction in the SDK means that developers must rely on manual code reviews or external security scanning tools to detect this issue before deployment, adding friction to secure development workflows.
To remediate this vulnerability, organizations should immediately upgrade their Amazon SageMaker Python SDK installations to version 3.10.0 for V3 users or version 2.257.3 for V2 users. These updated versions include fixes that ensure credentials are properly redacted from subprocess error outputs before they are written to logs. In addition to upgrading the software, it is recommended that security teams implement log filtering rules in CloudWatch Logs Insights or use AWS Lambda functions with Amazon Kinesis Data Firehose to automatically mask sensitive patterns such as passwords and tokens in real-time. This defense-in-depth approach ensures that even if future vulnerabilities arise where credentials are logged, they will not be exposed in plaintext. Regular audits of IAM policies should also be conducted to ensure that log access is restricted only to authorized personnel who require it for operational purposes, thereby minimizing the blast radius of any potential credential leakage incidents.