Skip to content
fr Sign in
7.2 High

CVE-2026-83551 Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker…

Description

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Affected products and versions

Product Affected versions Fixed in
sagemaker-python-sdk 3.11 earliest → < 3.11.0 3.11.0
sagemaker-python-sdk 2.256 earliest → < 2.256.0 2.256.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of sagemaker-python-sdk

The 3 CVEs of sagemaker-python-sdk →
CVE-2024-34072 sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker 7.8 High CVE-2024-34073 sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker 7.8 High
Track this CVE