CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Summary

CVE-2026-112408 affects the default_bucket() function in the Amazon SageMaker Python SDK, which uses a predictably named S3 bucket without checking that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials. Impacted versions are V2 before 2.257.3 and V3 from 3.0.0 before 3.10.0.

Mitigation

Fixed in V2 2.257.3 and V3 3.10.0, per the impacted version ranges given in the source.

Related items

• HighCVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro CrewSame vendor · AWS Security Bulletins
• MediumCVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDKSame vendor · AWS Security Bulletins
• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins
• CriticalCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSSame vendor · AWS Security Bulletins