CVE-2026-104019: Amazon SageMaker Distribution RCE Vulnerability

CVE-2026-104019 Overview

CVE-2026-104019 is an operating system (OS) command injection vulnerability [CWE-78] in the Studio Space startup validation script of Amazon SageMaker Distribution, as used by Amazon SageMaker Unified Studio. An authenticated user with project contributor permissions can inject shell commands through a crafted connection resource property. The injected commands execute inside another project member's Studio Space, exposing that member's temporary execution role credentials. The flaw affects SageMaker Distribution 2.x, 3.x, and the 4.0 through 4.4 minor lines prior to the fixed patch releases.

Critical Impact
An authenticated contributor can execute arbitrary commands in another project member's Studio Space and steal temporary AWS execution role credentials, enabling lateral movement across project workloads.

Affected Products

Amazon SageMaker Distribution 2.x before 2.14.12 and 3.x before 3.9.12
Amazon SageMaker Distribution 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3
Amazon SageMaker Unified Studio (consumer of the affected distribution images)

Discovery Timeline

2026-10-02 - CVE-2026-104019 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104019

Vulnerability Analysis

The vulnerability resides in the Studio Space startup validation script shipped with Amazon SageMaker Distribution. The script interpolates a connection resource property directly into a shell invocation without neutralizing shell metacharacters. When a Studio Space starts, the script processes connection metadata associated with the project. An attacker-controlled property value is passed to the shell as part of a command line.

Because the Studio Space executes under the identity of its owning project member, injected commands run with that member's permissions. The Studio Space also holds temporary AWS Identity and Access Management (IAM) credentials for the member's execution role. Those credentials are reachable from the compromised process environment, which lets the attacker pivot into AWS services the victim can access.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The startup validation logic concatenates a connection resource property into a shell command string rather than passing it as an argument vector or quoting it safely. Any shell metacharacter supplied by a project contributor becomes executable syntax when the Studio Space of another member starts.

Attack Vector

Exploitation requires authenticated access to a SageMaker Unified Studio project with contributor-level permissions. The attacker modifies a connection resource property to embed shell commands. When a different project member launches a Studio Space, the validation script interpolates the malicious value and executes the attacker's payload inside the victim's container. The attacker then reads the temporary execution role credentials from the Studio Space environment and uses them to call AWS APIs as the victim.

// No verified exploit code is published for CVE-2026-104019.
// Refer to the GitHub Security Advisory GHSA-w64x-664p-7w66 for
// vendor-provided technical details.

Detection Methods for CVE-2026-104019

Indicators of Compromise

Unexpected child processes spawned by the Studio Space startup validation script, especially shells, curl, wget, or AWS CLI invocations.
CloudTrail events in which a project member's execution role is used from an unexpected source IP, user agent, or API pattern.
Modifications to project connection resource properties that contain shell metacharacters such as ;, |, `, $(), or newline sequences.

Detection Strategies

Review audit logs for connection resource property changes submitted by contributor-level principals in the window preceding Studio Space restarts.
Correlate Studio Space start events with process execution telemetry inside the container to flag command chains that diverge from the known-good startup sequence.
Compare the IAM principal usage of execution role sessions against the Studio Space owner identity and alert on cross-member reuse.

Monitoring Recommendations

Enable AWS CloudTrail data events and ingest Studio Space container logs into a centralized analytics pipeline for anomaly detection.
Monitor Amazon SageMaker Unified Studio for connection resource edits followed by Studio Space restarts initiated by a different user.
Alert on execution role STS credential use from outside expected AWS Region or Virtual Private Cloud (VPC) endpoints.

How to Mitigate CVE-2026-104019

Immediate Actions Required

Upgrade SageMaker Distribution to the patched release matching the minor line in use: 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, or 4.4.3.
Restart active Studio Spaces so they adopt the patched image; in SageMaker Unified Studio, Studio Spaces pick up the latest patch of their minor line on restart.
Audit recent contributor activity on connection resources and rotate any execution role credentials suspected of exposure.

Patch Information

Amazon Web Services (AWS) published fixed images across all supported minor lines. Users on minor lines that have reached end of support must migrate to a supported minor line, because no patched version will be released for unsupported lines. Full remediation details appear in the AWS Security Bulletin 2026-125, the GitHub Security Advisory GHSA-w64x-664p-7w66, and the SageMaker Distribution release notes.

Workarounds

Restrict project contributor permissions so that only trusted principals can create or modify connection resources until patched images are deployed.
Validate and reject connection resource property values that contain shell metacharacters at the project governance layer.
Scope execution role policies with least privilege so that stolen credentials grant minimal blast radius across AWS services.

bash

# Verify the SageMaker Distribution image tag running in a Studio Space
cat /opt/conda/share/sagemaker-distribution/VERSION

# Example: confirm a patched 4.4.x image is in use
# Expected output should be 4.4.3 or later for the 4.4 line