CVE-2026-112408: SageMaker S3 bucket squatting

CISO Take

The Amazon SageMaker Python SDK's default_bucket() function uses a predictably named S3 bucket without verifying who owns it, so an attacker who pre-creates that bucket can feed malicious content into SageMaker workloads and achieve code execution in the execution environment, exposing IAM credentials. The CVSS score is 8.1 (High) and is held down by high attack complexity because the attacker must anticipate the bucket name and win the race to create it. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists yet, so there is no evidence of active exploitation, but the technique is well understood and low-cost. Because the stolen IAM role often has broad access to training data, model artifacts and other AWS services, the blast radius extends well beyond the notebook or job. Upgrade to SDK 3.10.0 (V3) or 2.257.3 (V2), and in the meantime set explicit, organization-owned S3 buckets instead of relying on default_bucket().

Sources:NVDGitHub Advisoryaws.amazon.comATLAS

What is the risk?

High. Impact is full confidentiality, integrity and availability loss within the SageMaker execution environment, including IAM credential theft. Exploitation requires no privileges and no user interaction over the network, but needs high complexity: the attacker must predict the bucket name and register it before the legitimate account does. No public exploit, scanner template, EPSS data or KEV listing is available, so near-term likelihood is moderate. Organizations that have never created the default bucket in a given region, or that use new accounts and regions, are the most exposed.

How does the attack unfold?

Bucket Pre-Creation

Attacker registers the predictably named SageMaker default S3 bucket in their own account before the victim creates it.

AML.T0010.001

Artifact Tampering

The SDK uploads code and artifacts to the unverified bucket, and the attacker replaces them with a malicious payload.

AML.T0018.002

Code Execution

The SageMaker job loads the tampered content and runs attacker code in the execution environment.

AML.T0050

Credential Theft and Impact

The attacker exfiltrates the execution role's IAM credentials and pivots to data, models and other AWS resources.

AML.T0055

Bucket Pre-Creation

Attacker registers the predictably named SageMaker default S3 bucket in their own account before the victim creates it.

AML.T0010.001

Artifact Tampering

The SDK uploads code and artifacts to the unverified bucket, and the attacker replaces them with a malicious payload.

AML.T0018.002

Code Execution

The SageMaker job loads the tampered content and runs attacker code in the execution environment.

AML.T0050

Credential Theft and Impact

The attacker exfiltrates the execution role's IAM credentials and pivots to data, models and other AWS resources.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
SageMaker	pip	—	No patch
49 dependents60% patched~122d to patchFull package profile →

Do you use SageMaker? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade the sagemaker package to 3.10.0 (V3) or 2.257.3 (V2) in notebooks, CI/CD runners, containers and pipelines. 2) Until patched, pass explicitly named, organization-owned buckets (default_bucket parameter or session configuration) and verify ownership with the expected bucket owner account ID. 3) Pre-create the default-named bucket in every account and region in use, and enable S3 Block Public Access. 4) Apply least-privilege to SageMaker execution roles and restrict S3 access with bucket ownership conditions such as aws:ResourceAccount. 5) Detect: review CloudTrail for CreateBucket events and for S3 access to sagemaker-* buckets owned by foreign accounts, and audit existing default buckets for unexpected ownership or contents. 6) Rotate IAM credentials and inspect model artifacts if a foreign-owned bucket is found.

How is it classified?

Supply ChainCode ExecutionData LeakageFrameworkTraining DataModelAML.T0010.001- AI Software AML.T0018.002- Embed Malware AML.T0055- Unsecured Credentials AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-112408?

The Amazon SageMaker Python SDK's default_bucket() function uses a predictably named S3 bucket without verifying who owns it, so an attacker who pre-creates that bucket can feed malicious content into SageMaker workloads and achieve code execution in the execution environment, exposing IAM credentials. The CVSS score is 8.1 (High) and is held down by high attack complexity because the attacker must anticipate the bucket name and win the race to create it. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists yet, so there is no evidence of active exploitation, but the technique is well understood and low-cost. Because the stolen IAM role often has broad access to training data, model artifacts and other AWS services, the blast radius extends well beyond the notebook or job. Upgrade to SDK 3.10.0 (V3) or 2.257.3 (V2), and in the meantime set explicit, organization-owned S3 buckets instead of relying on default_bucket().

Is CVE-2026-112408 actively exploited?

No confirmed active exploitation of CVE-2026-112408 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-112408?

1) Upgrade the sagemaker package to 3.10.0 (V3) or 2.257.3 (V2) in notebooks, CI/CD runners, containers and pipelines. 2) Until patched, pass explicitly named, organization-owned buckets (default_bucket parameter or session configuration) and verify ownership with the expected bucket owner account ID. 3) Pre-create the default-named bucket in every account and region in use, and enable S3 Block Public Access. 4) Apply least-privilege to SageMaker execution roles and restrict S3 access with bucket ownership conditions such as aws:ResourceAccount. 5) Detect: review CloudTrail for CreateBucket events and for S3 access to sagemaker-* buckets owned by foreign accounts, and audit existing default buckets for unexpected ownership or contents. 6) Rotate IAM credentials and inspect model artifacts if a foreign-owned bucket is found.

What systems are affected by CVE-2026-112408?

This vulnerability affects the following AI/ML architecture patterns: Training pipelines, Model serving, MLOps pipelines, Managed notebook environments, CI/CD for ML.

What is the CVSS score for CVE-2026-112408?

CVE-2026-112408 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.74%.

What is the AI security impact?

Affected AI Architectures

Training pipelinesModel servingMLOps pipelinesManaged notebook environmentsCI/CD for ML

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0018.002Embed Malware

AML.T0055Unsecured Credentials

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).

Exploitation Scenario

An attacker determines the naming pattern of the SDK default bucket, which is derived from predictable values such as region and account ID, and creates that bucket in their own AWS account before the victim does, configuring permissive access for the victim's role. When the victim's data scientist or pipeline calls default_bucket(), the SDK uses the attacker's bucket without validating ownership and uploads training code and artifacts. The attacker swaps the uploaded code or model artifact for a malicious payload, which the SageMaker job executes. The payload runs inside the execution environment and exfiltrates the role's IAM credentials, giving the attacker access to the victim's data, models and other AWS resources.

Weaknesses (CWE)

CWE-940Improper Verification of Source of a Communication Channel CWE-940Improper Verification of Source of a Communication Channel

CWE-940 — Improper Verification of Source of a Communication Channel: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

[Architecture and Design] Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

Source: MITRE CWE corpus.