CVE-2026-104019: sagemaker-distribution 2.8.0 to before 2.14.12, 3.3.0 to before 3.9.12, 4.0.0 to before 4.0.11, 4.1.0 to before…

Affected technology

sagemaker-distribution · 2.8.0 to before 2.14.12, 3.3.0 to before 3.9.12, 4.0.0 to before 4.0.11, 4.1.0 to before 4.1.11, 4.2.0 to before 4.2.8, 4.3.0 to before 4.3.5, 4.4.0 to before 4.4.3
AWS

Description’s affected range: before 2.14.12

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An authenticated remote user with project contributor permissions might execute arbitrary commands in another project member's Studio Space and obtain that member's temporary execution role credentials via a crafted connection resource property that is interpolated into a shell invocation without neutralization. Source advisory’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.