Cross-Tenant Data Leakage in AWS Bedrock via Model Customization Job Cache Flaw
Overview
A security vulnerability was identified in the AWS Bedrock service that could potentially allow for cross-tenant data leakage. The flaw resided in the backend infrastructure responsible for handling model customization and fine-tuning jobs. When a user submitted a fine-tuning job with their private dataset, the service would provision temporary compute resources to perform the training. Due to an improper resource isolation and cache clearing mechanism, fragments of the training data or intermediate model artifacts could be left behind in the local storage of the compute instance. When this instance was later de-provisioned and re-assigned to a different AWS customer for another fine-tuning job, the new customer could potentially access the stale data fragments from the previous tenant. A sophisticated attacker could have repeatedly initiated fine-tuning jobs to increase the probability of being assigned a 'dirty' instance and then inspected the local file system to exfiltrate sensitive data from other customers' fine-tuning datasets. AWS has since patched the issue by implementing stricter data sanitization and instance lifecycle management for the underlying compute fleet.
Affected Systems
Testing Guide
1. This vulnerability was patched on the server-side by AWS and cannot be tested by customers directly. 2. Customers can verify that their fine-tuning jobs are running on the patched infrastructure by checking the AWS Health Dashboard for any relevant security bulletins related to their account. 3. Reviewing historical job logs may help identify if any jobs were run during the potential exposure window, though confirming actual data leakage would be nearly impossible without AWS's assistance.
Mitigation Steps
1. This vulnerability was addressed by AWS on their backend infrastructure. No user action is required to receive the fix. 2. As a general best practice, always encrypt sensitive training data using customer-managed keys (CMK) through AWS KMS before submitting it to any AI service. 3. Regularly review AWS CloudTrail logs for any suspicious activity related to your Bedrock fine-tuning jobs. 4. Consider using VPC endpoints for Bedrock to ensure traffic between your VPC and the service does not traverse the public internet.
Patch Details
AWS patched their backend infrastructure on March 16, 2026. The fix was rolled out transparently to all regions.