Cross-Tenant Data Leakage in AWS Bedrock Fine-Tuning Cache
Overview
A high-severity information disclosure vulnerability was identified within the AWS Bedrock service, exposing a risk of cross-tenant data leakage in its model fine-tuning jobs. The root cause was a subtle flaw in the lifecycle management of underlying storage volumes used for the fine-tuning process. Researchers from a cloud security firm discovered that under specific, hard-to-reproduce race conditions, the storage cleanup protocol failed. When one customer's fine-tuning job concluded, either by succeeding or failing, the EBS volume containing their sensitive training data was not properly zeroed-out before being returned to the shared resource pool. Consequently, this 'stale' volume, still containing remnants of the previous customer's data, could be rapidly re-allocated to a new fine-tuning job initiated by a different customer in a separate account. An attacker could orchestrate this by submitting numerous, carefully timed fine-tuning jobs to increase the probability of receiving a non-sanitized volume. Upon receiving the volume, the attacker could immediately halt their own job and perform a raw block-level dump of the storage, allowing them to reconstruct and exfiltrate the previous tenant's proprietary training data. This could include source code, internal strategy documents, or datasets containing personally identifiable information (PII). AWS has since deployed a fix that enforces a mandatory cryptographic erase of all storage volumes upon deallocation, ensuring strict data isolation between tenants. No customer data was reported to be compromised as a result of this finding.
Affected Systems
Testing Guide
This vulnerability was on the AWS server side and has been patched globally. It is not possible for customers to test for its presence. Customers can verify that their fine-tuning jobs are operating under the patched infrastructure by checking the AWS Health Dashboard for security bulletin `AWS-2026-007` and confirming their services are operating in a region where the patch has been deployed.
Mitigation Steps
1. This was a server-side vulnerability patched by AWS. No user action is required for mitigation. 2. Review AWS Identity and Access Management (IAM) policies to ensure that only trusted entities have permission to start model fine-tuning jobs. 3. Implement data minimization principles for data submitted for fine-tuning, ensuring only necessary information is included. 4. Where possible, encrypt sensitive data within your training datasets using customer-managed keys (CMK) before uploading to the service.
Patch Details
The issue was remediated by AWS on their backend infrastructure on 2026-07-06. No customer-side patching is required.