PT-2026-41118 · Amazon · Sagemaker-Python-Sdk

Jam-Jee · Published 2026-05-14 · Updated 2026-05-25 · CVE-2026-8597

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 2.257.2 Amazon SageMaker Python SDK versions prior to 3.8.0

Description Missing integrity verification in the Triton inference handler allows a remote authenticated actor with S3 write access to the model artifact path to achieve code execution in inference containers. This is possible by replacing model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. Pickle is a Python module used for serializing and deserializing objects.

Recommendations Upgrade to version 2.257.2 and rebuild any Triton models previously created with ModelBuilder using the updated SDK. Upgrade to version 3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.

Exploit

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2026-8597

GHSA-RQ6V-X3J8-7QGF

Affected Products

Sagemaker-Python-Sdk

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8597.json · Exploit
• https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2 · Patch
• https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8597 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8597 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-031-aws · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq6v-x3j8-7qgf · Vendor Advisory
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rq6v-x3j8-7qgf · Note
• https://v.redd.it/hc0yhnnsxb3h1 · Reddit Post
• https://twitter.com/dailycve/status/2057552297488515371 · Twitter Post
• https://t.me/CVEtracker/53828 · Telegram Post