CVE-2026-104019

Executive Summary

CVE-2026-104019 is an OS command injection vulnerability (CWE-78) in the Studio Space startup validation script of Amazon SageMaker Distribution. An authenticated remote user holding project contributor permissions can supply a crafted connection resource property that is interpolated unsanitized into a shell invocation, enabling arbitrary command execution inside another project member's Studio Space and theft of that member's temporary execution role credentials. The flaw carries a CVSS 3.1 base score of 9.0 and affects all listed SageMaker Distribution 2.x, 3.x, and 4.x minor lines prior to their respective fixed releases; no patch has been verified by tracked sources and no public exploit code exists at time of writing.

Technical Analysis

The vulnerability resides in the Studio Space startup validation script shipped as part of Amazon SageMaker Distribution. Per the NVD description, the defect is an OS command injection where a "connection resource property" is "interpolated into a shell invocation without neutralization." The affected component is the startup validation logic executed when a Studio Space initializes; the vulnerable input is a connection resource property, which is a configuration attribute attached to a project resource that the platform resolves and passes into the startup path.

The root cause is CWE-78: a value controlled by a project contributor is concatenated or templated directly into a shell command string rather than being passed as an inert argument or validated against an allowlist. Because the shell interprets metacharacters within the interpolated string, an attacker who can set or influence the property can break out of the intended command context and append or substitute arbitrary commands. The CVSS vector indicates AV:N (network reachable), AC:L (low attack complexity), PR:L (low privileges — an authenticated project contributor suffices), UI:R (victim interaction required — the targeted member's Studio Space must start/validate), S:C (scope changed — execution crosses a security boundary from the attacker's project context into another member's Studio Space), with High confidentiality, integrity, and availability impact.

The scope-changed designation is the critical technical signal: the attacker and the victim are distinct principals, and the injected command executes under the victim Studio Space's runtime, which holds that member's temporary execution role credentials. The startup validation script thus becomes a confused-deputy channel — the attacker does not need credentials in the victim's account context; the vulnerable script executes on their behalf and, per the description, exposes the victim's temporary execution role credentials.

No public proof-of-concept, Nuclei template, or exploit code was available at the time of this report, and no specific variable names, function names, or file paths beyond "Studio Space startup validation script" and "connection resource property" are provided in the authoritative description. Claims about exact interpolation points or shell invocation syntax would be speculative and are therefore not asserted here.

Exploitation Scenarios

The following chain is inferred at the vulnerability-class level from the NVD description. No public PoC exists; specific implementation details are not available and are not fabricated below.

1. Reconnaissance / target identification. The attacker must already possess authenticated access to Amazon SageMaker Unified Studio with project contributor permissions. They enumerate projects and their members, identify a target project containing at least one other member who operates a Studio Space, and locate connection resources whose properties are reflected into Studio Space startup validation. Because the flaw is triggered through a property value, the attacker identifies which resource attributes are attacker-writable given contributor rights.

2. Triggering the flaw class. The attacker creates or modifies a connection resource property and sets its value to a string containing shell metacharacters (command separation/ substitution primitives). When a Studio Space in the project — specifically the victim member's Studio Space — starts or re-runs startup validation, the platform reads the property and interpolates it into the shell invocation. Because the value is not neutralized, the shell parses the injected metacharacters as command syntax instead of data.

3. Payload / execution at the class level. The injected content is executed as OS commands within the context of the Studio Space startup process. The attacker's goal, per the description, is two-fold: execute arbitrary commands in another project member's Studio Space, and exfiltrate that member's temporary execution role credentials. At the vulnerability-class level, credential theft typically involves reading the runtime credential material available to the Studio Space process (for example, environment or instance-metadata-backed temporary credentials) and returning it to an attacker-controlled destination — the exact mechanism is not specified in the available data.

4. Post-exploitation impact. With the victim's temporary execution role credentials, the attacker operates with the victim's permissions in AWS — the scope-changed condition in the CVSS vector. Depending on the role's policies, this can yield access to data, other project resources, and cloud APIs the victim role can reach. The High C/I/A ratings reflect the potential to read sensitive data, tamper with resources, and disrupt workflows, and the temporary nature of the credentials bounds the window unless the attacker can re-trigger the flaw.

No evidence of exploitation in the wild, no threat-actor attribution, and no CISA KEV listing are associated with this CVE in the supplied data.

Impact Assessment

The CVSS 3.1 base score is 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. Mapping the subscores to business impact:

• AV:N / AC:L — reachable over the network with low complexity once the attacker is an authenticated contributor; no special conditions or race windows are indicated.
• PR:L — the precondition is contributor-level access to a SageMaker Unified Studio project. This is a meaningful barrier, but contributor roles are commonly granted broadly across data-science teams, making the population of potential attackers large.
• UI:R — the victim member's Studio Space must start/validate for the injected command to run. Restarts, scheduled recycling, or the victim's own actions can satisfy this, so the interaction requirement is low-friction in practice.
• S:C — scope changes across a trust boundary: the attacker executes in the victim's Studio Space and obtains the victim's temporary execution role credentials. This is the most severe element, because attacker privileges are not the ceiling of impact.
• C:H / I:H / A:H — potential full compromise of confidentiality, integrity, and availability of resources reachable by the victim's execution role.

Blast radius: any Amazon SageMaker Unified Studio deployment using an affected SageMaker Distribution minor line. Because Studio Spaces adopt the latest patch of their minor line only on restart after patched images are deployed, un-restarted spaces remain exposed post-fix deployment. Multi-tenant projects where contributors and higher-privileged members share resources represent the worst case: a low-privileged contributor can obtain a higher-privileged member's credentials. End-of-support minor lines are permanently unfixable per the vendor guidance — no patched version will ship for them, so environments pinned to EOL lines have no patch path and must migrate.

Detection Guidance

Sigma Rule

title: Suspicious OS Command Injection in SageMaker Studio Space Startup Validation
id: 7f3c1b2a-9d4e-4a51-b8c7-2e6a0d1f9a44
status: experimental
description: Detects shell metacharacters in SageMaker connection resource properties or startup validation command lines indicative of CVE-2026-104019 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104019
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: 'EXECVE'
    exe|endswith:
      - '/bash'
      - '/sh'
  selection_cmd:
    a0|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '${IFS}'
      - 'connection'
  selection_sagemaker:
    exe|contains:
      - 'sagemaker'
      - 'studio'
      - 'startup'
  condition: selection_exec and selection_cmd and selection_sagemaker
falsepositives:
  - Legitimate startup scripts that use pipelines or command substitution
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.104019

YARA Rule

rule CVE_2026_104019_SageMaker_Connection_Injection
{
    meta:
        description = "Detects shell metacharacter injection patterns targeting SageMaker Studio Space startup validation (CVE-2026-104019)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104019"
        severity = "critical"

    strings:
        $sm1 = "startup validation" ascii nocase
        $sm2 = "Studio Space" ascii nocase
        $sm3 = "connection resource" ascii nocase
        $sm4 = "SageMaker" ascii nocase
        $meta1 = "$(" ascii
        $meta2 = "`" ascii
        $meta3 = "&&" ascii
        $meta4 = ";" ascii
        $meta5 = "|" ascii
        $creds1 = "execution role" ascii nocase
        $creds2 = "credential" ascii nocase

    condition:
        (any of ($sm*)) and (2 of ($meta*)) and (any of ($creds*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104019 Possible SageMaker Studio Space Command Injection in Connection Resource Property"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"connection"; content:"sagemaker"; nocase; http.request_body; content:"$("; nocase; http.request_body; content:"`"; nocase; http.request_body; content:"execution role"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026104019; rev:1; reference:cve,2026-104019; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [process where process.name in ("bash", "sh") and process.args : "*startup*" and process.args : "*validation*"]
  [process where event.action == "exec" and
     process.parent.name in ("bash", "sh") and
     (process.args : "*/bin/sh*" or process.args : "*curl*" or process.args : "*wget*" or process.args : "*base64*")]

Splunk SPL Query

index=aws sourcetype=aws:cloudtrail OR sourcetype=sagemaker:studio
| search (eventName=*Connection* OR eventName=*Resource* OR eventName=*Update*)
| where match(_raw, "(?i)(\$\(|`|;|&&|\|\|)") AND match(_raw, "(?i)(sagemaker|studio ?space|connection resource|startup)")
| stats count min(_time) as first_seen max(_time) as last_seen values(eventName) as events values(userIdentity.arn) as actor_arn by sourceIPAddress, requestParameters.name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="sagemaker,cve-2026-104019,">
  <rule id="1040191" level="12">
    <if_sid>100000</if_sid>
    <decoded_as>json</decoded_as>
    <field name="eventType">StudioSpaceStartup</field>
    <regex type="pcre2">(?i)(\$\(|`|&&|\|\||;).*(connection|startup|resource)</regex>
    <description>CVE-2026-104019: Potential command injection in SageMaker Studio Space startup validation from connection resource property.</description>
    <mitre>
      <id>T1059.004</id>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="1040192" level="13">
    <if_sid>1040191</if_sid>
    <regex type="pcre2">(?i)(execution role|credential|aws_secret|token)</regex>
    <description>CVE-2026-104019: Possible temporary execution role credential theft attempt following command injection.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description names fixed release versions, but no monitored patch source confirms availability, and the CVE is not listed in CISA KEV. Until a vendor advisory and verifiable fixed images are confirmed, treat all affected lines as unpatched.

1) Immediate mitigations

• Restrict project contributor permissions. The attack requires contributor rights; audit and reduce the population of users who can create or modify connection resources in projects that contain Studio Spaces.
• Prevent cross-member resource manipulation: isolate Studio Spaces per member so contributor-level changes cannot influence other members' spaces, and minimize the number of high-privilege roles operating within the same project as contributors.
• Limit permissions of Studio Space execution roles to the minimum necessary, reducing the impact of a stolen temporary role credential.
• Monitor the detection rules above for shell metacharacters in connection resource properties and for suspicious child processes spawned by startup validation.
• Rotate or shorten the lifetime of temporary execution role credentials where feasible to bound the exposure window.

2) Patch / upgrade steps

• Upgrade Amazon SageMaker Distribution code-level components to the release or higher for the applicable minor line:
  • 2.x → 2.14.12
  • 3.x → 3.9.12
  • 4.0.x → 4.0.11
  • 4.1.x → 4.1.11
  • 4.2.x → 4.2.8
  • 4.3.x → 4.3.5
  • 4.4.x → 4.4.3
• In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart after patched images are deployed; no version selection is required. Restart Studio Spaces after patched images deploy so the fix takes effect — un-restarted spaces remain vulnerable.
• Users on minor lines that have reached end of support must migrate to a supported minor line, because no patched version will be released for EOL lines.

3) Long-term hardening

• Apply secure coding practices that eliminate shell interpolation of untrusted resource properties: use argument-vector execution (no shell), strict input allowlisting, and property-value validation at the platform boundary.
• Adopt least-privilege IAM policies for Studio Space execution roles and scope them per project and per member to reduce cross-tenant blast radius.
• Integrate SAST/DAST and dependency scanning into the SageMaker Distribution build pipeline to catch CWE-78 patterns before release.
• Maintain an asset inventory of SageMaker Distribution minor lines in use, track EOL status proactively, and enforce prompt migration off unsupported lines.

References

• NVD — CVE-2026-104019: https://nvd.nist.gov/vuln/detail/CVE-2026-104019
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• FIRST CVSS v3.1 Specification (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H): https://www.first.org/cvss/specification-document
• Amazon SageMaker Unified Studio product documentation (Studio Spaces and project contributor roles): https://docs.aws.amazon.com/sagemaker/
• AWS Security Bulletins / Amazon SageMaker Distribution release notes (verify current patched image availability for the listed minor lines)

Known threat actor campaigns or exploit-in-the-wild evidence: none identified in the supplied data. No public PoC, no Nuclei template, no exploit code, and the CVE is not listed in CISA KEV.