Loading vulnerability…
S3 bucket ownership validation bypass in Amazon SageMaker Python SDK
CVE-2026-112408 affects default_bucket() in Amazon SageMaker Python SDK V2 before 2.257.3 and V3 before 3.10.0. The SDK resolves a predictably named default S3 bucket without reliably verifying that the caller's AWS account owns it. An existing ExpectedBucketOwner check executes only for buckets appearing in the caller's owned-bucket listing, leaving attacker-owned buckets on an unprotected branch; several upload and download operations also omit ownership validation. An attacker who pre-creates the expected bucket and permits victim access can intercept or modify executable code and machine-learning artifacts. Processing-job script injection and inference-endpoint serving-code injection can result in remote code execution and IAM credential theft.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of SageMaker workloads by executing attacker-controlled code with the workload's IAM role permissions. Demonstrated effects include theft of live execution-role credentials, environment variables, input data, and inference requests. Control of the storage also enables training-data exfiltration, data poisoning, model theft, and model artifact replacement. Injected endpoint code can remain active for the endpoint's lifetime while inference continues to return correct predictions. Further access using stolen credentials is constrained by the execution role's effective permissions.
If you can’t patch tonight, do this now.
If upgrading is not possible, explicitly configure an S3 bucket owned by your AWS account using the default_bucket parameter of sagemaker.Session or the SageMaker SDK configuration file rather than relying on automatic bucket selection. Verify ownership using HeadBucket with ExpectedBucketOwner. Pre-create required default buckets in the intended account before first use, or select explicitly configured, uniquely named trusted buckets. Where operationally appropriate, apply organization-level policies restricting access to externally owned S3 buckets and audit SageMaker workload bucket references against your owned-bucket inventory.
Patch, then assume compromise.
Upgrade Amazon SageMaker Python SDK V2 to version 2.257.3 or later, or V3 to version 3.10.0 or later, preferably the latest supported release. Update all environments that package or execute the SDK, including notebooks, developer environments, CI/CD images, and deployed automation. Incorporate the ownership-validation fixes into any forked or derivative code.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.