Amazon SageMaker CVE-2026-104019

Exploitation requires an authenticated remote user holding project contributor permissions within an Amazon SageMaker Unified Studio project (shared/multi-tenant project context), so this is an insider or compromised-collaborator scenario rather than external unauthenticated access. The attacker must supply a crafted connection resource property that is interpolated unsanitized into a shell invocation by the Studio Space startup validation script. The attack is additionally gated by user interaction (CVSS UI:P): a different project member's Studio Space must start/run that startup script for the injected command to execute against that member and expose their temporary execution-role credentials. Affected only on SageMaker Distribution 2.x<2.14.12, 3.x<3.9.12, 4.0.x<4.0.11, 4.1.x<4.1.11, 4.2.x<4.2.8, 4.3.x<4.3.5, 4.4.x<4.4.3; end-of-support minor lines receive no fix and must be migrated.

This is a genuinely high-priority flaw, not merely a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H) scores 9.3 and the metrics are internally consistent with the description: network reachable, low attack complexity, low privileges (an authenticated project contributor), and passive user interaction (a victim project member must use/restart their Studio Space). The CWE-78 OS command injection yields full code execution in another member's Studio Space plus theft of that member's temporary execution-role credentials, which explains the high confidentiality/integrity/availability and the subsequent-system (SC:H/SI:H) impact - a credential-theft/lateral-movement primitive within a shared project. Tempering factors: exploitation is NOT unauthenticated (PR:L requires valid project contributor permissions, i.e. an insider or compromised collaborator account) and requires victim interaction (UI:P). There is no CISA KEV listing, no public POC, and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the risk today is the capability, not observed campaigns. Net: credible insider/lateral-escalation threat warranting prompt patching in multi-tenant SageMaker Unified Studio projects, but gated behind existing project access and user interaction rather than being an internet-facing unauthenticated RCE.

A user holding project contributor permissions in an Amazon SageMaker Unified Studio project crafts a malicious connection resource whose property value contains shell metacharacters. When a different project member's Studio Space runs the startup validation script, the unsanitized property is interpolated into a shell invocation, executing the attacker's commands in that member's space and exposing their temporary execution-role credentials. No public exploit code is identified at time of analysis, and the attack depends on the victim's Studio Space starting (UI:P).