---
id: "CVE-2026-112408"
kind: "vulnerability"
aliases: ["CVE-2026-112408"]
title: "Amazon SageMaker Python SDK: unowned S3 bucket lets attackers run code"
severity: "critical"
cvss: 9.4
epss: 0.00719
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "lab-disclosure", "package", "python", "sagemaker"]
not_affected_if: ["already-upgraded"]
published_at: "2026-10-21T00:00:00+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T19:12:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112408", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112408", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/", "first_seen_at": "2026-10-24T19:12:57+00:00"}]
---

# Amazon SageMaker Python SDK: unowned S3 bucket lets attackers run code

The SageMaker Python SDK's default_bucket() function uses a predictably named S3 bucket without checking who owns it. An attacker who pre-creates that bucket can get code execution in the SageMaker environment and obtain its IAM credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed sagemaker version (pip show sagemaker) and whether it is below 3.10.0 for V3 or below 2.257.3 for V2.

## Fix

Upgrade the Amazon SageMaker Python SDK to 3.10.0 (V3) or 2.257.3 (V2).

## Mitigated for you by

- Team (workaround): covers Prevents default_bucket() from using the predictably named auto-generated S3 bucket by passing an S3 bucket the account owns explicitly via the default_bucket parameter of sagemaker.Session or the SageMaker SDK configuration file. Limits: none stated Still: Pass an S3 bucket your account owns through the default_bucket parameter of sagemaker.Session or the SDK configuration file, and do not rely on the auto-generated default bucket name. https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112408
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112408
- 2026-10-24T19:12:57+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/ — AWS: CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

## Documents

- [advisory] AWS: CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/

## From the sources

CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

### CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT

Description:

The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.

Impacted versions:

- V2: < 2.257.3
- V3: >= 3.0.0 and < 3.10.0

Resolution:

This issue has been addressed in Amazon SageMaker Python SDK versions 2.257.3 (V2) and 3.10.0 (V3). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

If you are not able to upgrade, pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session (or through the SageMaker SDK configuration file). Do not rely on the auto-generated default bucket name.

References:

- CVE-2026-112408
- GHSA-5rx8-8fr2-f855

Acknowledgement:

We would like to thank Dan Gansel from Upwind Security for collaborating on this issue through the coordinated disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_