AWS fixes SageMaker Python SDK bucket-ownership flaw CVE-2026-112408

The default_bucket() function in the SageMaker Python SDK previously generated a predictable bucket name and used it without checking account ownership. Versions prior to 2.257.3 (V2 line) and V3 versions 3.0.0 up to but excluding 3.10.0 are affected. AWS has released patched versions 2.257.3 and 3.10.0 that add ownership verification. As a workaround, administrators who cannot upgrade immediately should explicitly pass an S3 bucket their account owns via the default_bucket parameter of sagemaker.Session or the SDK configuration file, rather than relying on the auto-generated bucket name.

A remote attacker who pre-creates the predictably named bucket in their own account could hijack a victim's SageMaker execution environment, gaining code execution and access to the victim's IAM credentials. This could lead to broader AWS account compromise depending on the permissions attached to the SageMaker execution role. Administrators using the affected SDK versions should upgrade or apply the workaround to prevent credential theft and unauthorized access to their SageMaker environments and any resources reachable via the execution role's IAM credentials.