CVE-2026-110248

Awaiting Analysis Awaiting Analysis - Queue

Sensitive Information Exposure in Amazon SageMaker Python SDK

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: AMZN

Description

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110248

EUVD

EUVD-2026-101604

Affected Vendors & Products

Vendor	Product	Version / Range
AWS	SageMaker	Python SDK 0
AWS	SageMaker	Python SDK 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

CVE-2026-110248 is a vulnerability in the Amazon SageMaker Python SDK where sensitive repository credentials are logged in plaintext when a Git clone operation fails. The issue occurs in the git_utils.py component, which writes credentials from subprocess error output to CloudWatch Logs without redaction. An authenticated remote user with access to these logs could extract the plaintext credentials.

Detection Guidance

Check CloudWatch Logs for failed Git clone operations in the Amazon SageMaker Python SDK. Look for plaintext credentials in error messages or logs generated by git_utils.py. Review logs for any instances where repository URLs with embedded credentials appear in subprocess error output.

Impact Analysis

This vulnerability could allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs if a git clone operation fails. This may lead to unauthorized access to repositories, data breaches, or further exploitation of affected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive repository credentials in plaintext logs. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access to credentials may enable further breaches of regulated data.

Mitigation Strategies

Upgrade Amazon SageMaker Python SDK to V2 2.257.3 or later, or V3 3.10.0 or later.
Rotate any exposed repository credentials immediately if logs show plaintext credentials.
Avoid embedding credentials in Git repository URLs.
Restrict access to relevant CloudWatch Logs to minimize exposure.

Hi! I’m here to help you understand CVE-2026-110248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70