CVE-2026-112408: Amazon SageMaker Python SDK bucket ownership verification bypass

CVE-2026-112408 · Severity: high · CVSS 8.1 · Published 2026-10-21

The Amazon SageMaker Python SDK is a library for training and deploying machine learning models in AWS. A flaw in the default_bucket() function allows an attacker to create an S3 bucket with a predictable name before the legitimate user does, gaining code execution in the user's SageMaker environment and stealing AWS credentials. This could lead to unauthorized access to machine learning workloads and sensitive data.

Technologies: Amazon AWS, Amazon SageMaker Python SDK. Vendors: Amazon.

Quick answers

Is CVE-2026-112408 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112408 being exploited in the wild.
How severe is CVE-2026-112408?
High severity, with a CVSS score of 8.1, published 21 October 2026.
Which products and versions are affected?
Amazon SageMaker Python SDK V2: < 2.257.3, V3: >= 3.0.0 and < 3.10.0.
Is there a fix for CVE-2026-112408?
Yes: fixed in SageMaker Python SDK 2.257.3 (V2) and 3.10.0 (V3). Until then: Pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session or through the SageMaker SDK configuration file instead of relying on the auto-generated default bucket name. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112408 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-112408?
Check whether you run Amazon AWS or Amazon SageMaker Python SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: SageMaker Python SDK 2.257.3 (V2) and 3.10.0 (V3)

Pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session or through the SageMaker SDK configuration file instead of relying on the auto-generated default bucket name.

Technical details

The default_bucket() function in the SDK uses a predictably named S3 bucket without verifying that the AWS account of the caller owns it. An attacker can pre-create the S3 bucket in their own account, and when the SDK calls default_bucket(), it will use the attacker's bucket, executing code and exposing IAM credentials. The vulnerability requires network access and affects both V2 (pre-2.257.3) and V3 (3.0.0 through 3.9.x) versions.

Affected products

  • Amazon SageMaker Python SDK V2: < 2.257.3, V3: >= 3.0.0 and < 3.10.0

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.