CVE-2026-110248: SageMaker git clone error leaks

CISO Take

A flaw in the Amazon SageMaker Python SDK's git_utils.py writes plaintext Git repository credentials into CloudWatch Logs whenever a git clone operation fails, because the error output from the subprocess is not redacted. The CVSS score is a moderate 5.3 (high attack complexity, low privileges required), and there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no evidence of active exploitation. The risk is still real for organizations that pull training or processing code from private Git repositories using embedded tokens, because anyone with read access to the relevant log groups, which is often a wider audience than the repository itself, can harvest those credentials and gain access to source code. Upgrade to SageMaker Python SDK V3 3.10.0 or V2 2.257.3, rotate any Git tokens used with SageMaker jobs that failed to clone, and review CloudWatch Logs access and historical log entries for exposed secrets.

Sources:NVDGitHub Advisoryaws.amazon.comATLAS

What is the risk?

Medium overall. The CVSS vector (AV:N/AC:H/PR:L/UI:N) reflects that an attacker needs a low-privilege authenticated position and favorable conditions, specifically a failed git clone and read access to the logs. Impact is limited to confidentiality (C:H) with no integrity or availability effect. No KEV listing, public exploit or scanner template exists, so near-term exploitation likelihood is low. Severity rises when the leaked credential is a long-lived, broadly scoped token (for example an organization-wide personal access token) to a repository holding proprietary model code, pipelines or secrets.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated identity with read access to the SageMaker CloudWatch log groups.

AML.T0012

Trigger

A git clone in a SageMaker job fails and the SDK writes the unredacted credentialed URL to CloudWatch Logs.

Credential Harvesting

Attacker searches the logs and extracts the plaintext Git credentials.

AML.T0055

Impact

Attacker uses the stolen token to access private repositories and exfiltrate proprietary ML code and secrets.

AML.T0036

Initial Access

Attacker obtains a low-privilege authenticated identity with read access to the SageMaker CloudWatch log groups.

AML.T0012

Trigger

A git clone in a SageMaker job fails and the SDK writes the unredacted credentialed URL to CloudWatch Logs.

Credential Harvesting

Attacker searches the logs and extracts the plaintext Git credentials.

AML.T0055

Impact

Attacker uses the stolen token to access private repositories and exfiltrate proprietary ML code and secrets.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
SageMaker	pip	—	No patch
49 dependents60% patched~122d to patchFull package profile →

Do you use SageMaker? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade the sagemaker package to V3 3.10.0 or V2 2.257.3 in all notebooks, pipelines, CI/CD images and containers. 2) Search CloudWatch Logs for failed git clone events and for URLs containing embedded credentials (patterns such as https://user:token@), then rotate any exposed tokens. 3) Use short-lived, least-privilege, read-only deploy tokens, or store credentials in AWS Secrets Manager rather than inline in the URL. 4) Restrict log group read permissions via IAM and consider CloudWatch Logs data protection policies to mask secrets. 5) Detect: alert on credential-like strings in log streams and on unusual access to SageMaker log groups. 6) Review the AWS bulletin 2026-134-aws and GHSA-g6w4-jvgp-68x2.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionFrameworkTraining DataAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems / data and information security

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03:2025-Supply Chain

Frequently Asked Questions

What is CVE-2026-110248?

A flaw in the Amazon SageMaker Python SDK's git_utils.py writes plaintext Git repository credentials into CloudWatch Logs whenever a git clone operation fails, because the error output from the subprocess is not redacted. The CVSS score is a moderate 5.3 (high attack complexity, low privileges required), and there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no evidence of active exploitation. The risk is still real for organizations that pull training or processing code from private Git repositories using embedded tokens, because anyone with read access to the relevant log groups, which is often a wider audience than the repository itself, can harvest those credentials and gain access to source code. Upgrade to SageMaker Python SDK V3 3.10.0 or V2 2.257.3, rotate any Git tokens used with SageMaker jobs that failed to clone, and review CloudWatch Logs access and historical log entries for exposed secrets.

Is CVE-2026-110248 actively exploited?

No confirmed active exploitation of CVE-2026-110248 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110248?

1) Upgrade the sagemaker package to V3 3.10.0 or V2 2.257.3 in all notebooks, pipelines, CI/CD images and containers. 2) Search CloudWatch Logs for failed git clone events and for URLs containing embedded credentials (patterns such as https://user:token@), then rotate any exposed tokens. 3) Use short-lived, least-privilege, read-only deploy tokens, or store credentials in AWS Secrets Manager rather than inline in the URL. 4) Restrict log group read permissions via IAM and consider CloudWatch Logs data protection policies to mask secrets. 5) Detect: alert on credential-like strings in log streams and on unusual access to SageMaker log groups. 6) Review the AWS bulletin 2026-134-aws and GHSA-g6w4-jvgp-68x2.

What systems are affected by CVE-2026-110248?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, ML ops / job orchestration, model serving, notebook-based development environments.

What is the CVSS score for CVE-2026-110248?

CVE-2026-110248 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

training pipelinesML ops / job orchestrationmodel servingnotebook-based development environments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Exploitation Scenario

An engineer configures a SageMaker training job to clone a private repository using a personal access token embedded in the git_config. A branch name is misspelled or the network briefly fails, so the clone fails and the SDK logs the subprocess error, including the full credentialed URL, to CloudWatch Logs. An adversary with a low-privilege authenticated identity that can read the log group, such as a compromised analyst account or a over-permissioned third-party integration, retrieves the token from the logs. They then use it to clone the private repository, exfiltrate proprietary ML code and any secrets in it, and potentially pivot to other repositories the token can reach.

Weaknesses (CWE)

CWE-532Insertion of Sensitive Information into Log File CWE-532Insertion of Sensitive Information into Log File

CWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.

[Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
[Distribution] Remove debug log files before deploying the application into production.

Source: MITRE CWE corpus.