PT-2026-5708 · Amazon · Amazon Sagemaker Python Sdk

Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-1777

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 3.2.0 Amazon SageMaker Python SDK versions prior to 2.256.0

Description The Amazon SageMaker Python SDK contains the ModelBuilder HMAC signing key in cleartext within the response elements of the DescribeTrainingJob function. An attacker with permissions to call this API and modify objects in the Training Jobs S3 output location could potentially upload arbitrary artifacts. These artifacts may be executed when the Training Job is invoked.

Recommendations Update to Amazon SageMaker Python SDK version 3.2.0 or later. Update to Amazon SageMaker Python SDK version 2.256.0 or later.

Fix

Cleartext Transmission of Sensitive Information

Improper Certificate Validation

Weakness Enumeration

CWE-201

CWE-319

CWE-295

Related Identifiers

CVE-2026-1777

GHSA-RJRP-M2JW-PV9C

Affected Products

Amazon Sagemaker Python Sdk

References · 12

• https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.2.0 · Patch
• https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-004-AWS · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1777 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rjrp-m2jw-pv9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1777 · Security Note
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rjrp-m2jw-pv9c · Note
• https://github.com/aws/sagemaker-python-sdk/commit/fb0d789db4fd5fecde5509963939369f4c7ce63b · Note
• https://github.com/aws/sagemaker-python-sdk/commit/708c7b2f4135ecaec55973d098f3dbe98b657933 · Note
• https://twitter.com/CVEnew/status/2018465537446003089 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018527806678782324 · Twitter Post