To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AWS | SageMaker Python SDK | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3. | |
| Title | Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py | |
| First Time appeared |
Aws
Aws sagemaker Python Sdk |
|
| Weaknesses | CWE-532 | |
| CPEs | cpe:2.3:a:aws:sagemaker_python_sdk:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Aws
Aws sagemaker Python Sdk |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-10-14T18:36:59.562Z
Reserved: 2026-10-13T18:08:37.511Z
Link: CVE-2026-110248
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T19:17:10.343
Modified: 2026-10-14T19:17:10.343
Link: CVE-2026-110248
Redhat
No data.
OpenCVE Enrichment
No data.