CVE-2026-110248
Description
A flaw was found in the Amazon SageMaker Python SDK, which can lead to information disclosure. When a Git clone operation fails, the application fails to redact authentication credentials from command error output, recording them in plain text within system logs. An authenticated remote attacker with access to these logs can retrieve the exposed credentials and compromise protected repositories.
Statement
This vulnerability is rated as having Moderate impact for Red Hat environments because exploiting it requires an attacker to already hold authorized read permissions to CloudWatch or execution log files, and exposure only occurs when repository cloning fails. The Amazon SageMaker Python SDK is not provided within core Red Hat Enterprise Linux distributions, though it may be deployed within containerized workloads or custom virtual environments. The flaw is restricted to the leakage of credentials recorded during aborted subprocess calls, without granting direct remote code execution or broader system compromise.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
