Amazon SageMaker Python SDK: Missing bucket ownership verification in default_bucket()
Summary
The SageMaker Python SDK does not verify that the caller's AWS account owns the predictably named S3 bucket it uses by default. A remote attacker who pre-creates that bucket can achieve code execution in the SageMaker execution environment and obtain IAM credentials. The CVSS 4.0 score is 9.4 (Critical); CISA SSVC lists exploitation as none and automatable as no, and no public exploit is known.
Affected
- Amazon SageMaker Python SDK V2 before 2.257.3
- Amazon SageMaker Python SDK V3 from 3.0.0 before 3.10.0
- Forked or derivative code and third-party tools that bundle the SDK
Fixed in
- V2: 2.257.3
- V3: 3.10.0
Workaround
- Pass an S3 bucket your account owns explicitly via the default_bucket parameter of sagemaker.Session, or via the SageMaker SDK configuration file
- Do not rely on the auto-generated default bucket name
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public proof of concept or in-the-wild exploitation known as of 30 Oct 2026; this is not proof of absence
Our recommendation
- Inventory all SageMaker SDK installations, including Studio, notebooks, containers, CI jobs and bundled third-party packages
- Upgrade to 2.257.3 (V2) or 3.10.0 (V3) and patch forks
- If an upgrade is not possible, set an explicit, self-owned default bucket
- Monitor the AWS bulletin 2026-142-AWS and GHSA-5rx8-8fr2-f855 for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-142-AWS aws.amazon.com
- GitHub release v2.257.3 github.com
- GitHub release v3.10.0 github.com
- GitHub Security Advisory GHSA-5rx8-8fr2-f855 github.com
- PyPI sagemaker 2.257.3 pypi.org
- PyPI sagemaker 3.10.0 pypi.org
- VulDB CVE-2026-112408 vuldb.com
- OpenCVE CVE-2026-112408 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:57.
Original description (NVD)
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
NVD references (6)
- https://aws.amazon.com/security/security-bulletins/2026-142-aws/
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.3
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.10.0
- https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-5rx8-8fr2-f855
- https://pypi.org/project/sagemaker/2.257.3/
- https://pypi.org/project/sagemaker/3.10.0/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.