Amazon SageMaker Distribution: OS command injection in Studio Space startup

Summary

Amazon SageMaker Distribution images used in SageMaker Unified Studio contain an OS command injection flaw in the Studio Space startup validation script. An authenticated user with project contributor permissions can craft a connection resource property that is executed by the shell, which allows arbitrary commands in another project member's Space. The attacker can then obtain that member's temporary execution role credentials. The impact is greatest in shared projects with Trusted Identity Propagation enabled.

Affected

• AWS sagemaker-distribution 2.8.0 to before 2.14.12
• AWS sagemaker-distribution 3.3.0 to before 3.9.12
• AWS sagemaker-distribution 4.0.0 to before 4.0.11
• AWS sagemaker-distribution 4.1.0 to before 4.1.11
• AWS sagemaker-distribution 4.2.0 to before 4.2.8
• AWS sagemaker-distribution 4.3.0 to before 4.3.5
• AWS sagemaker-distribution 4.4.0 to before 4.4.3
• Lines 2.8.x to 2.13.x and 3.3.x to 3.8.x are affected, but end of support, so no fix will be released.
• 4.5.x is listed as not affected by the vendor bulletin.

Fixed in

• 2.14.12
• 3.9.12
• 4.0.11
• 4.1.11
• 4.2.8
• 4.3.5
• 4.4.3
• In Amazon SageMaker Unified Studio, the fix is deployed globally and applies to Spaces on the next restart.

Workaround

• None documented by the vendor.
• On end-of-support lines no patch exists, so migrating to a supported minor line is the only remedy listed.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No exploitation in the wild or public proof-of-concept reported in the sources.
• Not listed as known exploited (KEV) by Strix.
• Vendor rates the bulletin Important.

Our recommendation

• Confirm which SageMaker Distribution lines your projects and Spaces use.
• Restart all Spaces in SageMaker Unified Studio so the global fix applies.
• Identify Spaces on end-of-support lines (2.8 to 2.13, 3.3 to 3.8) and plan a move to a supported minor line.
• Verify the support status of lines 4.0.x and 4.1.x on the live AWS support policy page, as the cached copy suggests they may be out of support.
• Review who holds project contributor rights and whether Trusted Identity Propagation is enabled in shared projects.
• For self-managed images, pull the patched tags from the vendor release page. Unknown: the exact deployment steps for self-managed images.
• Ask the AWS account team to confirm whether 4.5.x is affected, as the sources do not clearly state this.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• AWS Security Bulletin 2026-125-AWS aws.amazon.com
• GitHub Security Advisory GHSA-w64x-664p-7w66 github.com
• SageMaker Distribution releases github.com
• SageMaker Distribution support policy github.com
• Strix CVE entry www.strix.ai
• Hol.org CVE entry hol.org
• OSV entry osv.dev
• Vulners Rapid7 entry vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:35.