CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution
Amazon SageMaker ยท 2026-10-02
Actions
Technical Details
| Affected Versions | 2.8.x - 2.13.x, 2.14.x < 2.14.12, 3.3.x - 3.8.x, 3.9.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, 4.4.x < 4.4.3 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-104019 |
| Migration Required | Yes |
| Cost Impact | Neutral |
What This Means
For DevOps Teams
Update Amazon SageMaker Distribution to versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, or 4.4.3 to address the OS command injection vulnerability (CVE-2026-104019) and ensure the security of your SageMaker Spaces.
For Platform Teams
Deploy the latest patched images for Amazon SageMaker Distribution to all Studio Spaces to sanitize connection details during startup and prevent potential security breaches due to OS command injection.
For Executives
Implement the security patch for Amazon SageMaker Distribution to mitigate the risk of unauthorized access and potential misuse of temporary execution role credentials, ensuring the integrity and security of your AI and ML projects.
Source
Related Amazon SageMaker Updates
- Amazon SageMaker Inference: 2026 year-to-date launches in review (2026-09-18)
- Introducing Amazon SageMaker HyperPod Inference Gateway (2026-09-18)
- Announcing instance preference lists for Amazon SageMaker AI training jobs (2026-09-15)
- Qwen3.6-35B-A3B-NVFP4 and Wan2.1-T2V-1.3B-Diffusers models now available on Amazon SageMaker JumpStart (2026-09-14)
- Ministral-3-3B-Instruct-2512 and Ministral-3-8B-Instruct-2512 models now available on Amazon SageMaker JumpStart (2026-09-14)