Vulnerability · Published Oct 14, 2026 · Assigned by AMZN

CVE-2026-110248Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Medium 5.3

In plain English

A medium-severity sensitive data in logs in SageMaker Python SDK from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Affected products (as reported)

Vendor	Product	Versions
AWS	SageMaker Python SDK	0 – before 2.257.30 – before 3.10.0

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://pypi.org/project/sagemaker/2.257.3/ release-notes, patch
https://pypi.org/project/sagemaker/3.10.0/ release-notes, patch
https://aws.amazon.com/security/security-bulletins/2026-134-aws/ vendor-advisory
https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-g6w4-jvgp-68x2 third-party-advisory