CVE-2026-112408
Last modified
CVE-2026-112408 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2)..
Description
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AWS | Amazon SageMaker Python SDK | < 2.257.3; >= 3.0.0, < 3.10.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-112408?
How severe is CVE-2026-112408?
How do I fix CVE-2026-112408?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-112402Pillow is a Python imaging library. Prior to 13.0.0, Pillow …8.7
- CVE-2026-112403Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…9.2
- CVE-2026-112404Pillow is a Python imaging library. From 8.1.0 until 13.0.0,…8.8
- CVE-2026-112405Pillow is a Python imaging library. From 12.0.0 until 13.0.0…8.7
- CVE-2026-112406Pillow is a Python imaging library. From 5.1.0 until 13.0.0,…8.7
- CVE-2026-112407Incorrect privilege assignment in the IAM policy of AWS CICD…8.8
- CVE-2026-11241Insufficient validation of untrusted input in Cast in Google…8
- CVE-2026-11242Insufficient validation of untrusted input in Plugins in Goo…7.5
- CVE-2026-11243Inappropriate implementation in Downloads in Google Chrome p…5.4
- CVE-2026-11244Insufficient validation of untrusted input in WebAuthenticat…3.1
- CVE-2026-11245Inappropriate implementation in Payments in Google Chrome pr…4.3
- CVE-2026-11246Insufficient validation of untrusted input in IndexedDB in G…5.3
Are you affected by CVE-2026-112408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST