CVE-2026-112408 in Amazon SageMaker Python SDK
Summary
by MITRE • 10/21/2026
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in the Amazon SageMaker Python SDK involves a critical failure in source verification within the default_bucket function, affecting versions prior to V3.10.0 and V2.257.3. This flaw stems from an insecure direct object reference mechanism where the SDK attempts to locate or create a bucket for storing artifacts without validating whether the application currently holds ownership of that resource. In cloud-native environments like Amazon SageMaker, code execution typically occurs within isolated containerized environments governed by specific IAM roles and permissions. When the SDK interacts with AWS S3 storage services, it relies on assumptions about the state of external resources to streamline development workflows. However, this convenience introduces a significant security gap when those assumptions are not rigorously enforced through cryptographic or ownership-based verification checks.
The technical core of this vulnerability lies in the predictable naming convention used for default buckets and the lack of an existence check that validates current access control policies before proceeding with operations. An attacker who has gained initial foothold within the SageMaker execution environment, perhaps through a compromised notebook instance or a vulnerable training job script, can exploit this behavior by pre-creating an S3 bucket with the exact name expected by the SDK. Because the code does not verify that it owns the bucket before using it for read-write operations, the application inadvertently grants its high-privilege IAM role access to write data into and potentially execute logic within a resource controlled entirely by the attacker. This effectively bypasses standard isolation boundaries between different AWS accounts or tenants sharing the same SageMaker domain.
The operational impact of this vulnerability is severe, primarily due to the potential for remote code execution and credential theft. By controlling the bucket content, an adversary can manipulate files that are subsequently processed by the SageMaker infrastructure. If these files trigger specific parsing logic or are used in model training pipelines, they may lead to arbitrary command injection within the container environment. Furthermore, because the SDK operates under the IAM role attached to the SageMaker instance, any actions taken via this compromised bucket inherit those elevated privileges. This allows attackers to exfiltrate sensitive data stored in other buckets accessible by that role or escalate their access further across the AWS account hierarchy. The ability to obtain IAM credentials through such means represents a classic privilege escalation path that undermines the principle of least privilege central to cloud security architectures.
This issue aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying ownership and permissions before performing operations on external resources. It also maps closely to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse as well as Cloud Service Discovery and Exfiltration over Alternative Protocol. The attack vector leverages the trust relationship between the application code and cloud storage services, exploiting a logic flaw rather than a traditional software bug like buffer overflow or injection syntax error. Such vulnerabilities are particularly dangerous in serverless and managed service contexts where developers often rely on default configurations that prioritize ease of use over strict security validation.
To mitigate this risk, organizations must immediately upgrade the Amazon SageMaker Python SDK to version 3.10.0 for V3 users or version 2.257.3 for V2 users. These updated versions implement proper ownership verification logic, ensuring that any bucket referenced by the default_bucket function is confirmed to be owned by the executing AWS identity before allowing write operations. In addition to upgrading dependencies, security teams should review IAM policies associated with SageMaker execution roles to ensure they adhere to least-privilege principles. Restricting S3 permissions to only necessary buckets and enabling logging via CloudTrail can help detect unauthorized bucket creation attempts. Regular audits of third-party libraries used in machine learning pipelines are essential to prevent similar supply chain or integration vulnerabilities from compromising critical AI/ML workloads.