{"id":"GHSA-5rx8-8fr2-f855","kind":"vulnerability","aliases":["GHSA-5rx8-8fr2-f855"],"related":[],"title":"CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()","description":"CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()\n\n### CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()\n\nBulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT\n\nDescription:\n\nThe Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.\n\nImpacted versions:\n\n- V2: < 2.257.3\n- V3: >= 3.0.0 and < 3.10.0\n\nResolution:\n\nThis issue has been addressed in Amazon SageMaker Python SDK versions 2.257.3 (V2) and 3.10.0 (V3). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you are not able to upgrade, pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session (or through the SageMaker SDK configuration file). Do not rely on the auto-generated default bucket name.\n\nReferences:\n\n- CVE-2026-112408\n- GHSA-5rx8-8fr2-f855\n\nAcknowledgement:\n\nWe would like to thank Dan Gansel from Upwind Security for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The SageMaker Python SDK's default_bucket() uses a predictably named S3 bucket without checking the caller's account owns it. An attacker who pre-creates that bucket can get code run in a SageMaker execution environment and obtain IAM credentials.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","ml-pipelines","package","python","sagemaker"],"not_affected_if":["explicit-default-bucket","sdk-not-used"],"how_to_check":"- Check the installed SDK version with `pip show sagemaker` and compare against the fixed versions.\n- Look for calls to `default_bucket()` or `sagemaker.Session` without an explicit `default_bucket` argument in your code.\n- Confirm whether the auto-generated default bucket name exists in an account you do not own (unknown how to check beyond this in the sources).","fix":"- Upgrade the SDK to `2.257.3` on the V2 line or `3.10.0` on the V3 line.\n- If you cannot upgrade, pass an S3 bucket your account owns explicitly via the `default_bucket` parameter of `sagemaker.Session` or the SageMaker SDK configuration file.\n- Patch any forked or derivative copies of the SDK.","status":"open","published_at":"2026-10-21T00:00:00+00:00","first_seen_at":"2026-10-24T19:12:57+00:00","triaged_at":"2026-10-25T05:04:07+00:00","updated_at":"2026-10-25T05:04:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:04:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the SDK to `2.257.3` on the V2 line or `3.10.0` on the V3 line.\n- If you cannot upgrade, pass an S3 bucket your account owns explicitly via the `default_bucket` parameter of `sagemaker.Session` or the SageMaker SDK configuration file.\n- Patch any forked or derivative copies of the SDK.","reach":"internet","title":"Amazon SageMaker Python SDK: default bucket ownership unchecked, enabling credential theft","impact":"high","summary":"The SageMaker Python SDK's default_bucket() uses a predictably named S3 bucket without checking the caller's account owns it. An attacker who pre-creates that bucket can get code run in a SageMaker execution environment and obtain IAM credentials.","category":"package","nicknames":[],"who_cares":["aws","sagemaker","python","ml-pipelines"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote code runs in SageMaker and IAM credentials are exposed","analyst_note":"Confirm the attack preconditions and whether the bucket-name prediction depends on account or region at https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/ and the linked GHSA advisory.","how_to_check":"- Check the installed SDK version with `pip show sagemaker` and compare against the fixed versions.\n- Look for calls to `default_bucket()` or `sagemaker.Session` without an explicit `default_bucket` argument in your code.\n- Confirm whether the auto-generated default bucket name exists in an account you do not own (unknown how to check beyond this in the sources).","needs_analyst":true,"not_affected_if":["explicit-default-bucket","sdk-not-used"],"who_is_affected":"Teams using the Amazon SageMaker Python SDK V2 before 2.257.3 or V3 from 3.0.0 before 3.10.0 that rely on the auto-generated default bucket name. Code that passes its own owned bucket explicitly to sagemaker.Session is not exposed through this path. Teams not using the SageMaker SDK can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":3935,"output_tokens":780,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112408':3A,79C,93C,150C,292C '-142':108C '-2026':2A,78C,92C,149C,291C '10/21/2026':119C '12':120C '2.257.3':204C,221C '2026':107C '3.0.0':206C '3.10.0':208C,224C '30':121C '5rx8':17A,22A,295C '8fr2':18A,23A,296C 'abl':252C 'account':53B,176C,261C 'achiev':188C 'acknowledg':298C 'actor':181C 'address':214C 'amazon':9A,85C,99C,126C,144C,164C,216C 'attack':57B 'attent':116C 'auto':284C 'auto-gener':283C 'aw':25B,109C,111C,175C 'aws-security@amazon.com':321C 'bucket':5A,14A,41B,47B,63B,81C,90C,95C,104C,156C,166C,185C,258C,267C,287C 'bulletin':105C 'caller':51B,173C 'check':49B,170C 'code':66B,189C,239C 'collabor':310C 'concern':327C 'configur':276C 'content':112C 'coordin':316C 'could':187C 'creat':61B,183C 'credenti':76B,200C 'cve':1A,77C,91C,148C,290C 'dan':304C 'date':118C 'default':13A,40B,89C,103C,155C,266C,286C 'deploy':139C 'deriv':238C 'descript':124C 'disclosur':28B,317C 'email':320C 'ensur':234C 'environ':72B,196C 'execut':71B,190C,195C 'explicit':263C 'f855':19A,24A,297C 'file':277C 'first':186C 'fix':246C 'fork':236C 'function':157C 'gansel':305C 'generat':285C 'get':65B 'ghsa':16A,21A,294C 'ghsa-5rx8-8fr2-f855':15A,20A,293C 'iam':75B,199C 'id':106C 'identifi':147C 'impact':201C 'import':114C 'incorpor':243C 'issu':152C,211C,313C 'lab':27B 'lab-disclosur':26B 'latest':231C 'learn':141C 'librari':135C 'like':301C 'machin':140C 'miss':4A,80C,94C 'ml':30B 'ml-pipelin':29B 'model':142C 'name':45B,163C,288C 'new':245C 'obtain':74B,198C 'open':133C 'open-sourc':132C 'own':54B,177C,262C 'ownership':6A,82C,96C 'packag':32B 'paramet':268C 'pass':255C 'patch':241C 'pdt':123C 'pipelin':31B 'pleas':319C 'pm':122C 'pre':60B 'pre-creat':59B 'predict':44B,162C 'process':318C 'public':117C 'python':11A,33B,37B,87C,101C,128C,218C 'question':325C 'recommend':227C 'refer':289C 'reli':280C 'remot':180C,193C 'requir':115C 'resolut':209C 'run':67B 's3':46B,165C,257C 'sagemak':10A,34B,36B,70B,86C,100C,127C,145C,194C,217C,274C 'sagemaker.session':270C 'scope':110C 'sdk':12A,38B,88C,102C,129C,159C,219C,275C 'secur':308C,324C 'sourc':134C 'thank':303C 'train':137C 'type':113C 'upgrad':228C,254C 'upwind':307C 'use':42B,160C 'v2':203C,222C 'v3':205C,225C 'verif':7A,83C,97C 'version':202C,220C,232C 'without':48B 'workaround':247C 'would':300C","nicknames":[],"mitigations":[],"who_affected":"Teams using the Amazon SageMaker Python SDK V2 before 2.257.3 or V3 from 3.0.0 before 3.10.0 that rely on the auto-generated default bucket name. Code that passes its own owned bucket explicitly to sagemaker.Session is not exposed through this path. Teams not using the SageMaker SDK can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/#GHSA-5rx8-8fr2-f855","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/","severity":null,"published_at":"2026-10-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"AWS: CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()"}],"documents":[{"id":2928,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-142-aws/","title":"AWS: CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()","kind":"advisory","source":"lab","text":"CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()\n\n### CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()\n\nBulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT\n\nDescription:\n\nThe Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.\n\nImpacted versions:\n\n- V2: < 2.257.3\n- V3: >= 3.0.0 and < 3.10.0\n\nResolution:\n\nThis issue has been addressed in Amazon SageMaker Python SDK versions 2.257.3 (V2) and 3.10.0 (V3). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nIf you are not able to upgrade, pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session (or through the SageMaker SDK configuration file). Do not rely on the auto-generated default bucket name.\n\nReferences:\n\n- CVE-2026-112408\n- GHSA-5rx8-8fr2-f855\n\nAcknowledgement:\n\nWe would like to thank Dan Gansel from Upwind Security for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-21T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}