CVE-2026-110248
Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
| CWE | CWE-532 |
| Vendor | aws |
| Product | sagemaker python sdk |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for aws sagemaker python sdk
Be the first to know when new medium vulnerabilities affecting aws sagemaker python sdk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
AWS / SageMaker Python SDK
0 < 2.257.3 0 < 3.10.0