PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110248 AWS CVE debrief

CVE-2026-110248 is an insertion of sensitive information into log files vulnerability in Amazon SageMaker Python SDK's git_utils.py component. The issue might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails. Users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3 to remediate this issue.

Vendor
AWS
Product
SageMaker Python SDK
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for Amazon SageMaker Python SDK deployments, particularly those using versions V3 before 3.10.0 or V2 before 2.257.3, should assess exposure and prioritize upgrading to the fixed versions.

Why it matters

CVE-2026-110248 is a medium-severity vulnerability in Amazon SageMaker Python SDK that might allow an authenticated remote user to obtain plaintext repository credentials. Defenders should prioritize upgrading to fixed versions and review affected deployments to prevent potential credential exposure.

  • Potential exposure of repository credentials in CloudWatch Logs
  • Need to verify affected deployments and upgrade to fixed versions
  • Possible impact on authentication and authorization in affected environments
  • Requires review of CloudWatch Logs for potential credential exposure

Technical summary

The git_utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 has a vulnerability that might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails. The runclone_command() function does not redact credentials from subprocess error output. This issue affects users with access to CloudWatch Logs, particularly defenders responsible for Amazon SageMaker Python SDK deployments. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Defensive priority

Defenders should prioritize upgrading to the fixed versions of Amazon SageMaker Python SDK to prevent potential exposure of repository credentials.

Recommended defensive actions

  • Upgrade to Amazon SageMaker Python SDK V3 3.10.0 or later
  • Upgrade to Amazon SageMaker Python SDK V2 2.257.3 or later
  • Review and update affected deployments
  • Monitor CloudWatch Logs for potential credential exposure
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. However, there is limited information on potential exploitation or victim impact. Defenders should verify affected deployments, review CloudWatch Logs for potential credential exposure, and assess the impact of obtaining plaintext repository credentials.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110248.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://pypi.org/project/sagemaker/2.257.3/

    Supplemental source - release-notes, patch

  • Source reference

    Unverified legacy reference

    URL: https://pypi.org/project/sagemaker/3.10.0/

    Supplemental source - release-notes, patch

  • Source reference

    Unverified legacy reference

    URL: https://aws.amazon.com/security/security-bulletins/2026-134-aws/

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-g6w4-jvgp-68x2

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.