CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

EUVD-2026-107541

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408

The Amazon SageMaker Python SDK is vulnerable to a flaw in the default_bucket() function, where the SDK fails to verify the ownership of S3 buckets. Specifically, versions V3 before 3.10.0 and V2 before 2.257.3 do not validate the source of the communication channel, allowing a remote actor to ac...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

Amazon SageMaker-Python-SDK authorization issue vulnerability

Amazon SageMaker-Python-SDK V3 versions prior to 3.10.0 and V2 versions prior to 2.257.3 contain an authorization issue vulnerability. This vulnerability stems from a lack of validation regarding the communication channel origin in the defaultbucket function. It may allow remote attackers to...

PT-2026-120795

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK V3 versions prior to 3.10.0 Amazon SageMaker Python SDK V2 versions prior to 2.257.3 Description Insufficient verification of the communication channel source within the default bucket function allows remote actors ...

CVE-2026-110248

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

EUVD-2026-101604

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248

The Amazon SageMaker Python SDK contains a vulnerability in the git_utils[.]py component affecting versions V3 before 3.10.0 and V2 before 2.257.3 . The runclone_command() function fails to redact credentials from subprocess error output during a failed git clone operation. This allows an authent...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

PT-2026-114022

Insertion of sensitive information into log files in the git utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because...

CVE-2026-83551

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...