CVE-2026-112408criticalCWE-940

CVE-2026-112408: fallo crítico en AWS Amazon SageMaker Python SDK

Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Amazon SageMaker Python SDK

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 0.7%
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
Productos afectados
AWS · Amazon SageMaker Python SDK
CVEs relacionadas — AWS Amazon SageMaker Python SDK

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-8596HIGHCleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve pathEPSS 0.6%CVE-2026-8597MEDIUMMissing integrity verification in Triton inference handler in Amazon SageMaker Python SDKEPSS 0.5%