CVE-2026-112408

The record

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).

Affected packages

Related vulnerabilities

• CVE-2026-119568 vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept()… CWE-940
• CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid… CWE-940
• CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using… CWE-940
• CVE-2026-87705 Improper verification of source of a communication channel in Windows Hyper-V allows an… CWE-940
• CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin… CWE-940
• CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a… CWE-940
• CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-940
• GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… CWE-940