CVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDK

Summary

CVE-2026-110248 affects the git_utils.py component of the Amazon SageMaker Python SDK, an open source library for training and deploying machine learning models on Amazon SageMaker. When a Git clone operation fails, repository credentials in subprocess error output are written to CloudWatch Logs without redaction, and an authenticated remote user with access to those logs can obtain the plaintext credentials.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins
• CriticalCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSSame vendor · AWS Security Bulletins
• HighCVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scanSame vendor · AWS Security Bulletins
• HighGHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file writeSame vendor · GitHub Advisory Database