Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Aws Amazon_Sagemaker_Python_Sdk
cpe:2.3:a:aws:amazon_sagemaker_python_sdk:*:*:*:*:*:*:*:*
|
0
|
2.257.3
|
|
Aws Amazon_Sagemaker_Python_Sdk
cpe:2.3:a:aws:amazon_sagemaker_python_sdk:*:*:*:*:*:*:*:*
|
3.0.0
|
3.10.0
|
References 6
https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.3
NVD
https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.10.0
NVD
https://pypi.org/project/sagemaker/3.10.0/
NVD
https://pypi.org/project/sagemaker/2.257.3/
NVD
https://aws.amazon.com/security/security-bulletins/2026-142-aws/
NVD
https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-5rx8-8fr2-…
NVD