AWS Fixes SageMaker SDK Default-Bucket Ownership Flaw
Tech GuruQuick Answer
AWS bulletin 2026-142-AWS fixes CVE-2026-112408 in the SageMaker Python SDK. Upgrade v2 to 2.257.3 or v3 to 3.10.0, verify that every resolved default bucket belongs to the calling account, review execution-role exposure, and retain remediation evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory SDK versions, default_bucket() use, buckets, Regions, execution roles, forks, and owners; upgrade to a fixed release or explicitly supply an account-owned bucket; verify ownership and policies; review credentials where exposure is plausible; test jobs; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Amazon SageMaker Python SDK v2 and v3 default_bucket() workflows |
|---|---|
| Advisory | 2026-142-AWS / GHSA-5rx8-8fr2-f855 |
| CVE | CVE-2026-112408 |
| Authoritative release date | 2026-10-21 19:30:00 UTC |
| Authority revision date | 2026-10-21 19:47:47 UTC |
| Affected versions | SageMaker Python SDK v2 before 2.257.3 and v3 from 3.0.0 before 3.10.0 when the predictable default bucket path is used without an explicitly owned bucket. |
| Fixed version | Amazon SageMaker Python SDK 2.257.3 or 3.10.0 |
| CVSS base score | 8.1 (CVSS v3.1) / 9.4 (CVSS v4.0) |
| CVSS severity | High to Critical |
| Exploitation status | AWS does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS corrected missing bucket-ownership verification in default_bucket(). A remote actor who pre-creates the predictable S3 bucket can cause a vulnerable SDK workflow to use attacker-controlled content, enabling code execution in the SageMaker execution environment and access to its IAM credentials.
What To Validate Now
- Inventory. Identify SageMaker Python SDK installations, exact major and patch versions, default_bucket() use, SDK configuration files, account and Region pairs, derived forks, execution roles, and owners.
- Establish applicability. Confirm whether each workflow relies on the auto-generated default bucket name and whether the current AWS account owns the resolved bucket. Do not infer safety from bucket naming or successful job execution.
- Remediate. Upgrade to SageMaker Python SDK 2.257.3 or 3.10.0 or later. Until upgraded, pass an S3 bucket owned by the caller's account explicitly through sagemaker.Session or the supported SDK configuration file, and patch derivative code.
- Validate. Confirm the installed SDK version, verify bucket ownership and policy in every Region, rotate or investigate exposed execution credentials when warranted, rerun representative jobs, and retain package, bucket, IAM, and deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
A predictably named bucket is not proof of ownership. Treat derived SDK forks and cached deployment artifacts separately, and do not rotate credentials solely from product-family presence without validating whether the vulnerable default-bucket path was used.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
