AWS Releases SageMaker SDK Patches to Fix Bucket Bypass Vulnerability CVE-2026-112408
Attackers could hijack SageMaker environments by pre-creating S3 buckets, a flaw now fixed in updated SDK versions.
Key points
- CVE-2026-112408 allows remote code execution in SageMaker via bucket ownership bypass
- AWS released patches for Python SDK V2 and V3 on October 21, 2026
- Users can mitigate by explicitly passing owned S3 buckets to the session parameter
Amazon published patches on October 21, 2026, for a high-severity flaw in its SageMaker Python SDK that allows attackers to execute code remotely. The vulnerability, tracked as CVE-2026-112408, stems from the SDK’s failure to verify ownership of a default Amazon S3 bucket used during operations.
At a glance
- CVE
- CVE-2026-112408
- Product
- AWS Amazon SageMaker Python SDK
- CVSS
- 8.1 High
- Weakness
- CWE-940
- Exploited
- No known exploitation
According to the AWS Security Bulletin 2026-142-AWS, the defect exists in the default_bucket() function. The SDK generates a predictably named S3 bucket and does not confirm that the caller’s AWS account created it. This lack of validation enables remote actors to pre-create the bucket and intercept subsequent SDK actions.
How the Exploit Works
A remote actor can exploit this issue by creating the expected S3 bucket before the target SageMaker job runs. Because the SDK does not validate bucket ownership, it connects to the attacker’s pre-created bucket. This manipulation allows the attacker to achieve code execution within the remote SageMaker execution environment.
Once the attacker gains code execution capabilities, they can obtain IAM credentials associated with the SageMaker environment. The National Vulnerability Database assigns the flaw a CVSS score of 8.1, rating it as high severity. The weakness is classified under CWE-940 for missing verification of the source of a communication channel.
Affected Versions
The vulnerability impacts specific versions of the Amazon SageMaker Python SDK, an open-source library for training and deploying machine learning models. AWS states that V2 versions prior to 2.257.3 are affected. Similarly, V3 versions from 3.0.0 up to, but not including, 3.10.0 contain the flaw.
Users running older releases of either major version chain are exposed to this risk. AWS addressed the issue in Amazon SageMaker Python SDK version 2.257.3 for the V2 branch and version 3.10.0 for the V3 branch. The vendor advises upgrading to these patched versions immediately to close the security gap.
What should you do?
AWS recommends that all users upgrade to the latest patched versions of the Amazon SageMaker Python SDK. If an immediate upgrade is not feasible, administrators can mitigate the risk by explicitly passing an S3 bucket that their account owns through the default_bucket parameter of sagemaker.Session. Alternatively, users can configure the bucket via the SageMaker SDK configuration file.
Do not rely on the auto-generated default bucket name if you cannot patch. Ensure that any forked or derivative code is also updated to incorporate the new fixes. AWS thanked Dan Gansel from Upwind Security for collaborating on the coordinated disclosure of this issue.
What to do and how to stay safe: AWS
- Inventory all instances using the SageMaker Python SDK to identify V2 or V3 versions below the patched thresholds.
- Apply the latest SDK updates to your development and production environments as soon as they are available.
- Configure explicit S3 bucket parameters in your session code to avoid using predictably named default buckets.
- Monitor IAM credentials and execution logs for unauthorized access patterns if you are running vulnerable versions.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-112408?
It is a high-severity vulnerability in the Amazon SageMaker Python SDK that allows remote code execution through missing S3 bucket ownership verification.
Which SDK versions are affected?
V2 versions before 2.257.3 and V3 versions from 3.0.0 to 3.10.0 are affected by this flaw.
How can I mitigate the risk without patching?
You can pass an explicitly owned S3 bucket through the default_bucket parameter or the SDK configuration file to avoid the vulnerable auto-generation logic.
