SageMaker Python SDK CVE-2026-110248

Exploitation requires all of: (1) a vulnerable SageMaker Python SDK version (V3 <3.10.0 or V2 <2.257.3) performing a git clone via runclone_command() with credentials embedded in the repository URL; (2) that clone operation actually FAILING, so subprocess error output containing the un-redacted credentials is written to CloudWatch Logs; and (3) the attacker holding authenticated AWS access with permission to read the relevant CloudWatch Log groups/streams (PR:L). Limiting factors that reduce realistic risk: the clone must fail (AT:P - not a guaranteed condition), the attacker must already be authenticated to the AWS environment, and only repository credentials (not AWS credentials) are exposed, so impact is confidentiality-only.

This is a medium-severity information-disclosure flaw (CWE-532) with a genuinely constrained real-world risk profile rather than a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) tells a consistent story: although the attack surface is network-reachable (CloudWatch Logs), exploitation requires existing authenticated access (PR:L) and a specific attack precondition (AT:P) - namely that a git clone operation actually fails and writes credential-bearing subprocess error output to the logs. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals do not conflict: a high confidentiality impact (plaintext repository credentials) is offset by the need for a pre-authenticated actor and a non-guaranteed failure condition, which is exactly why the base score lands at 6.0 rather than critical. The main residual risk is lateral/privilege escalation - leaked git credentials could grant access to source repositories beyond the AWS account - so this should be remediated promptly in environments where SageMaker training/processing jobs clone private repos, but it is not an urgent internet-facing RCE-class emergency. Note: EPSS data was not supplied and should be checked to refine prioritization.

An authenticated user in an AWS account with permission to read CloudWatch Logs triggers (or waits for) a SageMaker git clone that fails - e.g. a transient error or bad branch - causing runclone_command() to log the full repository URL including embedded plaintext credentials. The attacker then reads those CloudWatch Log streams and harvests the repository credentials for reuse against the source control system. No public exploit code is available, and the attack is gated by the required clone failure and existing log-read access.