CVE-2026-110248 | BDVDB-2026-389461 Detail

Description#

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-14Record published in the CVE List.
2. Version 22026-10-15Most recent update recorded in the CVE List.