This vulnerability arises from the SageMaker Python SDK’s default_bucket() function, which fails to verify the ownership of the S3 bucket it references. Without ownership checks, an attacker can pre-create a predictably named bucket and cause the SDK to use it during SageMaker job execution. This flaw allows code execution within the SageMaker execution environment and can also expose IAM credentials tied to that environment. The weakness is classified as data‑validity and authorization bypass, matching CWE‑940.

The affected product is the Amazon SageMaker Python SDK provided by AWS. Versions earlier than 3.10.0 (V3) and earlier than 2.257.3 (V2) are vulnerable. All users of these earlier SDK releases, including notebooks, scripts, and automated pipelines that invoke default_bucket(), are impacted.

The flaw receives a CVSS score of 9.4, indicating critical severity and remote code execution potential. EPSS is not available, but the lack of a KEV listing does not reduce the inherent risk. The most likely attack vector is an adversary who can influence the creation or naming of the default bucket—such as by leveraging existing IAM permissions to create a bucket with a name that the SDK will automatically use. Once the bucket is in place, the SDK will rely on it without validating ownership, enabling malicious code or data to be read or executed in the target SageMaker environment.