Skip to content
Threat Feed
Subscribe

Product

SageMaker Python SDK (< 3.10.0, < 2.257.3)

1 brief RSS
high advisory

Amazon SageMaker Python SDK: S3 bucket pre-creation remote code execution (CVE-2026-112408)

The Amazon SageMaker Python SDK fails to verify S3 bucket ownership in the default_bucket() function, allowing attackers to pre-create predictable buckets for IAM credential theft or remote code execution.

SageMaker Python SDK cloud-security remote-code-execution credential-theft amazon
2t 1c