{"id":"CVE-2026-104019","kind":"vulnerability","aliases":["CVE-2026-104019"],"related":[],"title":"Amazon SageMaker Distribution: command injection in Space startup script","description":"CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution\n\n### CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution\n\nBulletin ID: 2026-125-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 13:00 PM PDT\n\nDescription:\n\nAmazon SageMaker Unified Studio is an AWS service that unifies data, analytics, and AI development. It lets you find and access your organization's data and act on it with integrated, purpose-built tools.\n\nWe identified CVE-2026-104019, an issue with the startup of SageMaker Spaces in SageMaker Unified Studio. The startup script in a SageMaker Space performs a network validation against all the available SageMaker connections in a project. Under certain conditions, improper sanitization of connection details during this validation could allow arbitrary code to be executed in the Space of another project member. In projects with the Trusted Identity Propagation feature enabled, this issue could result in a user with project contributor permissions (or higher) gaining access to another member's temporary execution role credentials and calling downstream trusted identity propagation-enabled AWS services on their behalf.\n\nWe implemented a fix to all supported SageMaker Distribution versions to sanitize connection details during the startup validation process. The fix is deployed globally and will apply to all Spaces automatically on the next startup.\n\nImpacted versions:\n\n- 2.8.x - 2.13.x: all versions affected, no fix (end of support)\n- 2.14.x: < 2.14.12, fixed in 2.14.12\n- 3.3.x - 3.8.x: all versions affected, no fix (end of support)\n- 3.9.x: < 3.9.12, fixed in 3.9.12\n- 4.0.x: < 4.0.11, fixed in 4.0.11\n- 4.1.x: < 4.1.11, fixed in 4.1.11\n- 4.2.x: < 4.2.8, fixed in 4.2.8\n- 4.3.x: < 4.3.5, fixed in 4.3.5\n- 4.4.x: < 4.4.3, fixed in 4.4.3\n- 4.5.x: not affected\n- < 2.8.0 and < 3.3.0: not affected\n\nResolution:\n\nThis issue has been addressed in SageMaker Distribution versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, and 4.4.3. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required. We recommend restarting any spaces for these minor versions to receive this update.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-104019\n- GHSA-w64x-664p-7w66\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"A flaw in the startup validation script of SageMaker Spaces lets improper sanitization of connection details run arbitrary OS commands inside a Space. In projects with Trusted Identity Propagation, another project member can reach the victim's temporary execution role credentials.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","data-science","infrastructure","lab-disclosure","sagemaker","sagemaker-unified-studio"],"not_affected_if":["pre-2.8-or-pre-3.3","version-4.5"],"how_to_check":"- Check the SageMaker Distribution image version in use: `2.14.x` below `2.14.12`, `3.9.x` below `3.9.12`, `4.0.x` below `4.0.11`, `4.1.x` below `4.1.11`, `4.2.x` below `4.2.8`, `4.3.x` below `4.3.5`, `4.4.x` below `4.4.3` are affected\n- Versions `2.8.x` through `2.13.x` and `3.3.x` through `3.8.x` are affected with no fix (end of support)\n- Versions `4.5.x` and anything below `2.8.0` or `3.3.0` are not affected","fix":"- Restart all SageMaker Spaces on the affected minor lines so they pick up the patched image: `2.14.12`, `3.9.12`, `4.0.11`, `4.1.11`, `4.2.8`, `4.3.5`, `4.4.3`\n- Move Spaces on end-of-support lines (`2.8.x` to `2.13.x`, `3.3.x` to `3.8.x`) to a supported version; no patch is provided\n- No workaround is documented by AWS","status":"open","published_at":"2026-10-02T20:17:00+00:00","first_seen_at":"2026-10-24T19:12:57+00:00","triaged_at":"2026-10-25T02:59:49+00:00","updated_at":"2026-10-25T02:59:49+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T02:59:49Z","model":"claude-haiku-5-5","output":{"fix":"- Restart all SageMaker Spaces on the affected minor lines so they pick up the patched image: `2.14.12`, `3.9.12`, `4.0.11`, `4.1.11`, `4.2.8`, `4.3.5`, `4.4.3`\n- Move Spaces on end-of-support lines (`2.8.x` to `2.13.x`, `3.3.x` to `3.8.x`) to a supported version; no patch is provided\n- No workaround is documented by AWS","reach":"network","title":"Amazon SageMaker Distribution: command injection in Space startup script","impact":"high","summary":"A flaw in the startup validation script of SageMaker Spaces lets improper sanitization of connection details run arbitrary OS commands inside a Space. In projects with Trusted Identity Propagation, another project member can reach the victim's temporary execution role credentials.","category":"infrastructure","nicknames":[],"who_cares":["sagemaker","aws","sagemaker-unified-studio","data-science"],"confidence":0.85,"needs_auth":"yes","worst_case":"Arbitrary code runs in another member's Space and steals their execution role credentials","analyst_note":"Confirm the GHSA-w64x-664p-7w66 advisory and the CVSS 9.3 vector on the NVD page; check whether Trusted Identity Propagation is the only path to credential theft.","how_to_check":"- Check the SageMaker Distribution image version in use: `2.14.x` below `2.14.12`, `3.9.x` below `3.9.12`, `4.0.x` below `4.0.11`, `4.1.x` below `4.1.11`, `4.2.x` below `4.2.8`, `4.3.x` below `4.3.5`, `4.4.x` below `4.4.3` are affected\n- Versions `2.8.x` through `2.13.x` and `3.3.x` through `3.8.x` are affected with no fix (end of support)\n- Versions `4.5.x` and anything below `2.8.0` or `3.3.0` are not affected","needs_analyst":true,"not_affected_if":["version-4.5","pre-2.8-or-pre-3.3"],"who_is_affected":"Teams running SageMaker Spaces in Amazon SageMaker Unified Studio on an affected SageMaker Distribution image, most of all projects with Trusted Identity Propagation enabled, where a contributor can reach another member's execution role credentials. The fix is deployed globally and applies on the next Space restart, but Spaces on end-of-support lines get no fix at all.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000886,"input_tokens":4314,"output_tokens":910,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-104019':12A,15A,72C,88C,161C,441C '-125':105C '-2026':11A,14A,71C,87C,160C,440C '00':118C '10/02/2026':116C '13':117C '2.13':303C '2.14':313C '2.14.12':315C,318C,386C '2.8':301C '2.8.0':371C '2026':104C '3.3':319C '3.3.0':373C '3.8':321C '3.9':331C '3.9.12':333C,336C,387C '4.0':337C '4.0.11':339C,342C,388C '4.1':343C '4.1.11':345C,348C,389C '4.2':349C '4.2.8':351C,354C,390C '4.3':355C '4.3.5':357C,360C,391C '4.4':361C '4.4.3':363C,366C,393C '4.5':367C '664p':445C '7w66':446C 'access':142C,242C 'act':148C 'address':381C 'adopt':401C 'affect':307C,325C,370C,375C 'ai':135C 'allow':206C 'amazon':1A,83C,99C,122C,395C 'analyt':133C 'anoth':58B,216C,244C 'appli':290C 'arbitrari':46B,207C 'attent':113C 'automat':294C 'avail':188C 'aw':16B,106C,108C,128C,259C 'aws-security@amazon.com':449C 'behalf':263C 'built':155C 'bulletin':102C 'call':252C 'certain':195C 'code':208C 'command':4A,48B,74C,90C 'concern':455C 'condit':196C 'connect':43B,190C,200C,276C 'content':109C 'contributor':237C 'could':205C,230C 'credenti':69B,250C 'cve':10A,13A,70C,86C,159C,439C 'data':18B,132C,146C 'data-sci':17B 'date':115C 'deploy':286C,416C 'descript':121C 'detail':44B,201C,277C 'develop':136C 'disclosur':23B 'distribut':3A,85C,101C,272C,384C 'downstream':253C 'email':448C 'enabl':227C,258C 'end':310C,328C 'execut':67B,211C,248C 'featur':226C 'find':140C 'fix':267C,284C,309C,316C,327C,334C,340C,346C,352C,358C,364C 'flaw':30B 'gain':241C 'ghsa':443C 'ghsa-w64x-664p-7w66':442C 'global':287C 'higher':240C 'id':103C 'ident':56B,224C,255C 'identifi':158C 'imag':414C 'impact':299C 'implement':265C 'import':111C 'improp':40B,197C 'infrastructur':20B 'inject':5A,75C,91C 'insid':49B 'integr':152C 'issu':163C,229C,378C 'lab':22B 'lab-disclosur':21B 'latest':403C 'let':39B,138C 'line':408C 'member':60B,218C,245C 'minor':407C,430C 'network':183C 'next':297C 'none':437C 'organ':144C 'os':47B,73C,89C 'patch':404C,413C 'pdt':120C 'perform':181C 'permiss':238C 'pleas':447C 'pm':119C 'process':282C 'project':53B,59B,193C,217C,220C,236C 'propag':57B,225C,257C 'propagation-en':256C 'public':114C 'purpos':154C 'purpose-built':153C 'question':453C 'reach':62B 'receiv':433C 'recommend':424C 'refer':438C 'requir':112C,422C 'resolut':376C 'restart':410C,425C 'result':231C 'role':68B,249C 'run':45B 'sagemak':2A,24B,26B,37B,84C,100C,123C,168C,171C,179C,189C,271C,383C,396C 'sagemaker-unified-studio':25B 'sanit':41B,198C,275C 'scienc':19B 'scope':107C 'script':9A,35B,81C,97C,176C 'secur':452C 'select':420C 'servic':129C,260C 'space':7A,38B,51B,79C,95C,169C,180C,214C,293C,400C,427C 'startup':8A,33B,80C,96C,166C,175C,280C,298C 'studio':28B,78C,94C,125C,173C,398C,399C 'support':270C,312C,330C 'temporari':66B,247C 'tool':156C 'trust':55B,223C,254C 'type':110C 'unifi':27B,124C,131C,172C,397C 'updat':435C 'user':234C 'valid':34B,184C,204C,281C 'version':273C,300C,306C,324C,385C,419C,431C 'victim':64B 'w64x':444C 'workaround':436C 'x':302C,304C,314C,320C,322C,332C,338C,344C,350C,356C,362C,368C","nicknames":[],"mitigations":[],"who_affected":"Teams running SageMaker Spaces in Amazon SageMaker Unified Studio on an affected SageMaker Distribution image, most of all projects with Trusted Identity Propagation enabled, where a contributor can reach another member's execution role credentials. The fix is deployed globally and applies on the next Space restart, but Spaces on end-of-support lines get no fix at all.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-02T20:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/#CVE-2026-104019","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"AWS: CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution"},{"source":"nvd","external_id":"CVE-2026-104019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104019","severity":null,"published_at":"2026-10-02T20:17:00+00:00","modified_at":"2026-10-06T18:16:43+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null}],"documents":[{"id":2930,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/","title":"AWS: CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution","kind":"advisory","source":"lab","text":"CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution\n\n### CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution\n\nBulletin ID: 2026-125-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 13:00 PM PDT\n\nDescription:\n\nAmazon SageMaker Unified Studio is an AWS service that unifies data, analytics, and AI development. It lets you find and access your organization's data and act on it with integrated, purpose-built tools.\n\nWe identified CVE-2026-104019, an issue with the startup of SageMaker Spaces in SageMaker Unified Studio. The startup script in a SageMaker Space performs a network validation against all the available SageMaker connections in a project. Under certain conditions, improper sanitization of connection details during this validation could allow arbitrary code to be executed in the Space of another project member. In projects with the Trusted Identity Propagation feature enabled, this issue could result in a user with project contributor permissions (or higher) gaining access to another member's temporary execution role credentials and calling downstream trusted identity propagation-enabled AWS services on their behalf.\n\nWe implemented a fix to all supported SageMaker Distribution versions to sanitize connection details during the startup validation process. The fix is deployed globally and will apply to all Spaces automatically on the next startup.\n\nImpacted versions:\n\n- 2.8.x - 2.13.x: all versions affected, no fix (end of support)\n- 2.14.x: < 2.14.12, fixed in 2.14.12\n- 3.3.x - 3.8.x: all versions affected, no fix (end of support)\n- 3.9.x: < 3.9.12, fixed in 3.9.12\n- 4.0.x: < 4.0.11, fixed in 4.0.11\n- 4.1.x: < 4.1.11, fixed in 4.1.11\n- 4.2.x: < 4.2.8, fixed in 4.2.8\n- 4.3.x: < 4.3.5, fixed in 4.3.5\n- 4.4.x: < 4.4.3, fixed in 4.4.3\n- 4.5.x: not affected\n- < 2.8.0 and < 3.3.0: not affected\n\nResolution:\n\nThis issue has been addressed in SageMaker Distribution versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, and 4.4.3. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required. We recommend restarting any spaces for these minor versions to receive this update.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-104019\n- GHSA-w64x-664p-7w66\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}