psf-sagemaker-check(8)

Script: /opt/psf-security-patches/sagemaker/sagemaker-check.sh. Tool page: SageMaker SDK. Source. With the package installed: man psf-sagemaker-check.

Amazon SageMaker Python SDK default_bucket() takeover: read-only checker  (v1)
CVE-2026-112408

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

The SDK's default_bucket() uses an S3 bucket named sagemaker-{region}-{AWS account ID}
and, in affected versions, does not check that the bucket belongs to your account.
Region and account ID are not secret, so another AWS account can pre-create a bucket
with that name; the SDK then reads from and writes to the attacker's bucket, which can
give the attacker code execution in your SageMaker execution environment and your IAM
credentials. Amazon rates it 8.1 (CVSS 3.1); the CNA record also carries 9.4.

  Affected: V2 before 2.257.3, and V3 (3.0.0) before 3.10.0
  Fixed:    2.257.3 and 3.10.0 (both exist on PyPI). The fix adds an
            ExpectedBucketOwner check to the SDK's S3 operations.
  Bulletin: https://aws.amazon.com/security/security-bulletins/2026-142-aws/

A separate flaw in the same releases (repository credentials written to CloudWatch
Logs by git_utils) is fixed by the same upgrade; it is not counted separately here.

This script is read-only and makes no AWS calls. It finds installed copies and pinned
versions, and lists the Python files and notebooks that call default_bucket() so you
know where the default bucket is relied on. It cannot tell whether someone has
already pre-created your bucket name: see the manual check it prints.

Usage:
  ./sagemaker-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /usr/lib /usr/local/lib /opt /srv /var/lib /home
                   /root). Exit 0 = nothing affected, 1 = an affected SDK found.
  version          print the script version.
Containers: with no argument the check also looks in running docker and podman containers
(SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe copies the package metadata
directories and the lock, requirements and environment files that mention sagemaker (index URLs
and credentials are dropped inside the container) into a private temporary directory, and this
script runs once per container in isolation against that copy. Paths shown as .../docker_NAME/...
are inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.