Cross-Tenant Model Data Leakage in AWS Bedrock Fine-Tuning Jobs
Overview
A high-severity vulnerability was identified in the AWS Bedrock service that could lead to cross-tenant data leakage from model fine-tuning jobs. The vulnerability stemmed from a subtle race condition in the lifecycle management of the temporary S3 storage used during the fine-tuning process. When a customer submitted a fine-tuning job, Bedrock would provision a service-managed S3 bucket to store the training data. Upon job completion or failure, a cleanup process was initiated to delete the data and bucket. Researchers found that under specific load conditions, it was possible for a new fine-tuning job from a different AWS account (Tenant B) to be allocated storage resources that were pending cleanup from a previous job run by Tenant A. A flaw in the IAM role permission scoping for the job's execution role could grant Tenant B's job transient read access to the cached, undeleted data from Tenant A before the cleanup process completed. While the window of opportunity was small, a determined attacker could repeatedly trigger fine-tuning jobs to probe for and potentially access sensitive training datasets from other customers. AWS has since patched the issue by enforcing stricter data isolation and synchronous cleanup operations.
Affected Systems
Testing Guide
This vulnerability was on the cloud provider's side and cannot be tested by customers. AWS has confirmed the issue is resolved and all customers are protected. You can verify the security of your configuration by ensuring that IAM policies for Bedrock access are scoped with the principle of least privilege and that your training data S3 buckets have strict access controls and logging enabled.
Mitigation Steps
1. This vulnerability was in the AWS control plane and was patched by AWS. No customer action is required for mitigation. 2. For enhanced security, always encrypt your training data using a Customer-Managed Key (CMK) in AWS KMS before submitting it to any AI service. This provides an additional layer of protection. 3. Regularly review AWS CloudTrail logs for your Bedrock usage, looking for any anomalous activity related to fine-tuning jobs or S3 access patterns.
Patch Details
AWS deployed a silent patch to their backend infrastructure in late June 2026. A security bulletin was issued to customers on July 2nd, 2026.