Bulletin ID: 2026-142-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/21/2026 12:30 PM PDT
Description:
The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.
Impacted versions:
– V2: < 2.257.3
– V3: >= 3.0.0 and < 3.10.0
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the original article: