Cpe:2.3:a:amazon:sagemaker_python_sdk:*:*:*:*:*:*:*:*

The Amazon SageMaker Python SDK fails to verify S3 bucket ownership in the default_bucket() function, allowing attackers to pre-create predictable buckets for IAM credential theft or remote code execution.