CVE-2026-83551

EUVD-2026-69418

01.09.2026, 19:17

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-312 - Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

https://aws.amazon.com/security/security-bulletins/2026-093-aws/

https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0

https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.11.0

https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7xmc-crrw-fv5r