CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
// summary
CVE-2026-112408 affects SageMaker Python SDK default_bucket(), which uses predictable S3 bucket names without ownership checks, enabling first-creation by another account.
// from the source
Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT Description: The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could