--- id: "GHSA-w64x-664p-7w66" kind: "vulnerability" aliases: ["GHSA-w64x-664p-7w66"] title: "CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution" severity: "high" cvss: null epss: null exploited: false status: "open" category: "infrastructure" products: [] ecosystems: [] tags: ["aws", "infrastructure", "lab-disclosure", "sagemaker", "sagemaker-unified-studio", "trusted-identity-propagation"] not_affected_if: ["single-member-project", "version-4.5.x", "version-below-2.8.0-or-3.3.0"] published_at: null first_seen_at: "2026-10-24T19:12:57+00:00" updated_at: "2026-10-25T04:51:38+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/", "first_seen_at": "2026-10-24T19:12:57+00:00"}] --- # CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution The startup script for SageMaker Spaces in SageMaker Unified Studio does not sanitize connection details during its network validation, so under certain conditions arbitrary code can run in another project member's Space. In projects with Trusted Identity Propagation enabled, a contributor could also obtain another member's temporary execution role credentials and call downstream AWS services as them. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the SageMaker Distribution image version of each Studio Space against the impacted ranges in the bulletin, for example by reviewing the image tag or the Space's image in SageMaker Unified Studio. - Check whether the project has Trusted Identity Propagation enabled. - Check the SageMaker Distribution version line: 2.8.x through 2.13.x and 3.3.x through 3.8.x have no fix. ## Fix - Restart Studio Spaces so they pick up the latest patch of their minor line: `2.14.12`, `3.9.12`, `4.0.11`, `4.1.11`, `4.2.8`, `4.3.5`, or `4.4.3`. - Move Spaces on unsupported lines (2.8.x to 2.13.x, 3.3.x to 3.8.x) to a supported version, since no fix is provided for them. - Workarounds: none. ## Timeline - 2026-10-24T19:12:57+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/ — AWS: CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution ## Documents - [advisory] AWS: CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution https://aws.amazon.com/security/security-bulletins/rss/2026-125-aws/ ## From the sources CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution ### CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution Bulletin ID: 2026-125-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 13:00 PM PDT Description: Amazon SageMaker Unified Studio is an AWS service that unifies data, analytics, and AI development. It lets you find and access your organization's data and act on it with integrated, purpose-built tools. We identified CVE-2026-104019, an issue with the startup of SageMaker Spaces in SageMaker Unified Studio. The startup script in a SageMaker Space performs a network validation against all the available SageMaker connections in a project. Under certain conditions, improper sanitization of connection details during this validation could allow arbitrary code to be executed in the Space of another project member. In projects with the Trusted Identity Propagation feature enabled, this issue could result in a user with project contributor permissions (or higher) gaining access to another member's temporary execution role credentials and calling downstream trusted identity propagation-enabled AWS services on their behalf. We implemented a fix to all supported SageMaker Distribution versions to sanitize connection details during the startup validation process. The fix is deployed globally and will apply to all Spaces automatically on the next startup. Impacted versions: - 2.8.x - 2.13.x: all versions affected, no fix (end of support) - 2.14.x: < 2.14.12, fixed in 2.14.12 - 3.3.x - 3.8.x: all versions affected, no fix (end of support) - 3.9.x: < 3.9.12, fixed in 3.9.12 - 4.0.x: < 4.0.11, fixed in 4.0.11 - 4.1.x: < 4.1.11, fixed in 4.1.11 - 4.2.x: < 4.2.8, fixed in 4.2.8 - 4.3.x: < 4.3.5, fixed in 4.3.5 - 4.4.x: < 4.4.3, fixed in 4.4.3 - 4.5.x: not affected - < 2.8.0 and < 3.3.0: not affected Resolution: This issue has been addressed in SageMaker Distribution versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, and 4.4.3. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required. We recommend restarting any spaces for these minor versions to receive this update. Workarounds: None. References: - CVE-2026-104019 - GHSA-w64x-664p-7w66 Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_