Is CVE-2026-110248 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110248?

CVE-2026-110248 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-110248

Description

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.