Amazon SageMaker Python SDK: S3 bucket pre-creation remote code execution (CVE-2026-112408)
The Amazon SageMaker Python SDK fails to verify S3 bucket ownership in the default_bucket() function, allowing attackers to pre-create predictable buckets for IAM credential theft or remote code execution.
CVE search metadata
CVE search record: CVE-2026-112408. Severity: high. CVSS: 8.1. KEV: no. Product: SageMaker Python SDK (< 3.10.0, < 2.257.3). Brief: Amazon SageMaker Python SDK: S3 bucket pre-creation remote code execution (CVE-2026-112408). Brief link: https://feed.craftedsignal.io/briefs/2026-10-sagemaker-sdk-cve/
Triage facts
Revision 1- Applicability
- SageMaker Python SDK (< 3.10.0, < 2.257.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 23:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-112408 identifies a vulnerability in the Amazon SageMaker Python SDK where the default_bucket() function does not perform adequate ownership validation of S3 buckets. An attacker who can predict the name of an S3 bucket that the SDK intends to use can pre-create that bucket. Because the SDK fails to verify its own ownership or the existence of a prior owner, it may proceed to use the attacker-controlled bucket. This can lead to the exposure of IAM credentials used by the SageMaker execution environment or allow for remote code execution within that environment.
Impact
Successful exploitation may result in the compromise of IAM credentials associated with the SageMaker execution role and remote code execution within the SageMaker environment.
Recommendation
Upgrade the Amazon SageMaker Python SDK to version 3.10.0 (for V3 users) or 2.257.3 (for V2 users) to implement proper bucket ownership validation.
Mitigations
Upgrade Amazon SageMaker Python SDK to version 3.10.0 or 2.257.3
CVE-2026-112408