Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2…
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Amazon Web Services
- Product
- AWS services
- CVSS
- 8.1
- Exposure class
- Cloud platform
Why it ranks 15 (Routine)
- CVSS 8.1 high
- Product class: cloud platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-112408 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.