Skip to content
Sign in
5.9 Medium

CVE-2026-1778 Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made…

Description

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed.

Affected products and versions

Product Affected versions Fixed in
SageMaker Python SDK 3.1 earliest → < 3.1.1 3.1.1
SageMaker Python SDK 2.256 earliest → < 2.256.0 2.256.0

Other CVEs of SageMaker Python SDK

The 3 CVEs of SageMaker Python SDK →
CVE-2026-110248 Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3… 5.3 Medium CVE-2026-1777 The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext… 7.2 High
Track this CVE