OS Command Injection Vulnerability in Amazon SageMaker by Amazon

CVE-2026-104019

What is CVE-2026-104019?

An OS command injection vulnerability exists in the Studio Space startup validation script of Amazon SageMaker Distribution. This issue may allow an authenticated remote user with project contributor permissions to execute arbitrary commands within another project member's Studio Space. By exploiting a crafted connection resource property, the attacker can manipulate shell invocations to gain unauthorized access to another user’s temporary execution role credentials. To mitigate this risk, it is essential for users to upgrade to the specified safe versions depending on their currently deployed minor line. Users on unsupported minor lines must transition to a supported one, as no patches will be provided for end-of-life versions.

References