CVE-2026-83551

HIGH 7.2

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

CWE	CWE-312
Vendor	aws
Product	sagemaker-python-sdk
Published	Sep 1, 2026
Last Updated	Sep 1, 2026

Stay Ahead of the Next One

Get instant alerts for aws sagemaker-python-sdk

Be the first to know when new high vulnerabilities affecting aws sagemaker-python-sdk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

AWS / sagemaker-python-sdk

0 < 3.11.0 0 < 2.256.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0 github.com: https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.11.0 aws.amazon.com: https://aws.amazon.com/security/security-bulletins/2026-093-aws/ github.com: https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7xmc-crrw-fv5r