Amazon SageMaker SDK EUVD-2026-107541

Exploitation requires the attacker to pre-create an S3 bucket whose name matches the SDK's predictable default (the sagemaker-prefixed region/account-ID pattern consumed by default_bucket()) BEFORE the victim's SDK first provisions it, and the victim must then invoke a SageMaker workflow that calls default_bucket() on the unpatched SDK (V2 < 2.257.3 or V3 < 3.10.0). This is the AT:P attack requirement: the attacker needs an AWS account and must know or predict the target's account ID and region, and must win the race before the victim already owns that bucket. Key LIMITING factors: if the target has already created its default bucket the attack fails (favoring first-time / newly-onboarded environments), success is unauthenticated against the target (PR:N) but gated on the pre-creation race, and only the two listed vulnerable SDK version ranges are affected - upgrading to 3.10.0 or 2.257.3 adds the missing bucket-ownership validation and remediates it.

The vendor-assigned CVSS 4.0 base score is 9.4 (Critical) with vector AV:N/AC:L/AT:P/PR:N/UI:N and high impact to confidentiality, integrity and availability of both the vulnerable system (VC:H/VI:H/VA:H) and a subsequent system (SC:H), consistent with remote code execution plus IAM credential theft reached without authentication or user interaction. The single most important nuance is AT:P (Attack Requirements: Present): exploitation is not a simple one-shot network request - it depends on a condition outside the attacker's control, namely that the attacker pre-creates the predictably named S3 bucket BEFORE the victim's SDK first provisions it, and that the victim then runs the vulnerable workflow. This materially tempers the raw 9.4: the flaw is a pre-positioning / namespace-squatting race rather than a wormable, broadly-automatable RCE, so realistic exploitation is more targeted and opportunistic than widespread. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified and there is NO evidence of active exploitation. The reporter is the vendor itself (AMZN) with a coordinated GHSA advisory and AWS security bulletin, which raises confidence in the technical details but does not imply in-the-wild activity. Net assessment: a genuine high-priority issue for organizations running the affected SDK versions (patch promptly), but the AT:P race precondition means it is less of a mass-exploitation emergency than the 9.4 headline alone suggests.

An attacker who can enumerate or guess a target's AWS account ID and region pre-creates an S3 bucket matching the SDK's predictable default naming pattern (e.g. sagemaker-{region}-{account-id}). When the victim later runs a SageMaker workflow, the vulnerable default_bucket() uses that attacker-owned bucket without verifying ownership, letting the attacker serve malicious artifacts/code that execute in the SageMaker execution environment and expose the attached IAM role credentials. No public exploit identified at time of analysis; the AV:N/AC:L vector makes the actions easy once the AT:P pre-creation condition is satisfied.