Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-110248

Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AWS SageMaker Python SDK

Default version status: unaffected

  • 0 to < 2.257.3affected
  • 0 to < 3.10.0affected

References