Amazon Sagemaker Python Sdk
Monthly
Code execution inside the target SageMaker execution environment, together with disclosure of the execution role's IAM credentials, is reachable through the Amazon SageMaker Python SDK's default_bucket() helper, which provisions and then consumes an S3 bucket whose name is derived predictably from the account ID and region but never verifies who actually owns that bucket. The defect affects V3 releases before 3.10.0 and V2 releases before 2.257.3; a remote actor who registers that predictable bucket name in their own AWS account first can influence the artifacts, scripts and data the victim's training, processing and hosting jobs read and write, which the vendor scores 9.4 (Critical) under CVSS 4.0 and which our independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attacker must win a bucket-name pre-creation race. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation favors newly onboarded or not-yet-provisioned environments, since targets that already own their default bucket are not exposed.
Code execution inside the target SageMaker execution environment, together with disclosure of the execution role's IAM credentials, is reachable through the Amazon SageMaker Python SDK's default_bucket() helper, which provisions and then consumes an S3 bucket whose name is derived predictably from the account ID and region but never verifies who actually owns that bucket. The defect affects V3 releases before 3.10.0 and V2 releases before 2.257.3; a remote actor who registers that predictable bucket name in their own AWS account first can influence the artifacts, scripts and data the victim's training, processing and hosting jobs read and write, which the vendor scores 9.4 (Critical) under CVSS 4.0 and which our independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attacker must win a bucket-name pre-creation race. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation favors newly onboarded or not-yet-provisioned environments, since targets that already own their default bucket are not exposed.