PT-2026-5709 · Amazon · Amazon Sagemaker Python Sdk

Published 2026-02-02 · Updated 2026-02-02 · CVE-2026-1778

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 3.1.1 Amazon SageMaker Python SDK versions prior to 2.256.0

Description The SageMaker Python SDK has an issue where TLS certificate verification is disabled for HTTPS connections when importing a Triton Python model. This allows requests with invalid or self-signed certificates to succeed, potentially leading to remote code execution within the Triton container. Disabling SSL verification allows third parties to intercept HTTPS traffic and replace models or dependencies with inappropriate versions.

Recommendations Versions prior to 3.1.1 should be upgraded to version 3.1.1 or later. Versions prior to 2.256.0 should be upgraded to version 2.256.0 or later. Customers using self-signed certificates for internal model downloads should add their private Certificate Authority (CA) certificate to the container image.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-599

Related Identifiers

CVE-2026-1778

GHSA-62RC-F4V9-H543

Affected Products

Amazon Sagemaker Python Sdk

References · 11

• https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.1.1 · Patch
• https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-004-AWS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1778 · Security Note
• https://osv.dev/vulnerability/GHSA-62rc-f4v9-h543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1778 · Vendor Advisory
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-62rc-f4v9-h543 · Note
• https://github.com/aws/sagemaker-python-sdk/commit/c8098958910f7db78d07037425debfd4d44a6964 · Note
• https://github.com/aws/sagemaker-python-sdk/commit/5e7a3efa7bec0a161194ffa0cef346dda93bf2c6 · Note
• https://twitter.com/CVEnew/status/2018465536405868718 · Twitter Post