---
id: CVE-2026-112408
title: >-
  Missing bucket ownership verification in Amazon SageMaker Python SDK
  default_bucket()
summary: >-
  Missing verification of source of a communication channel in the
  default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and
  V2 before 2.257.3 might allow remote actors to achieve code execution in the
  target SageMaker …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-940
vendor: AWS
product: Amazon SageMaker Python SDK
affected:
  - amazon_sagemaker_python_sdk < 2.257.3
  - amazon_sagemaker_python_sdk >= 3.0.0 < 3.10.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T19:47:47.503Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112408'
references:
  - url: 'https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.3'
  - url: 'https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.10.0'
  - url: 'https://pypi.org/project/sagemaker/3.10.0/'
  - url: 'https://pypi.org/project/sagemaker/2.257.3/'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-142-aws/'
  - url: >-
      https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-5rx8-8fr2-f855
tags:
  - cve.org
ingestedAt: '2026-10-21T20:11:44.903Z'
---

## Overview

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.



To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).

## Affected

- `amazon_sagemaker_python_sdk < 2.257.3`
- `amazon_sagemaker_python_sdk >= 3.0.0 < 3.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.