Sensitive Information Exposure in Amazon SageMaker Python SDK
CVE-2026-110248

6MEDIUM

Key Information:

Vendor

Aws

Status
Sagemaker Python Sdk
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110248?

The Amazon SageMaker Python SDK contains a vulnerability in the git_utils[.]py component that allows sensitive information, such as plaintext repository credentials, to be logged in CloudWatch Logs during failed git clone operations. This occurs because the runclone_command() function does not sanitize the error output of subprocesses. An authenticated remote user could exploit this oversight to retrieve sensitive data from the log files, potentially compromising security. Users are advised to upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3 to mitigate this risk.

Affected Version(s)

SageMaker Python SDK 0 < 2.257.3

SageMaker Python SDK 0 < 3.10.0

References

https://pypi.org/project/sagemaker/2.257.3/
release-notespatch
https://pypi.org/project/sagemaker/3.10.0/
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.