SageMaker Python SDK CVE-2026-83551

Exploitation requires all three of the following: (1) the attacker is an authenticated IAM principal within the same AWS account as the victim - cross-account exploitation is not described; (2) the attacker holds the sagemaker:DescribePipeline IAM permission, which is a standard grant in data science roles; (3) the victim's pipelines use the @step or @remote decorator in an SDK version prior to v2.256.0 (v2 branch) or v3.11.0 (v3 branch). Exploitation is strictly intra-account and cannot be performed by unauthenticated principals or external parties. The attack is further limited to accounts where at least one pipeline has been created with the vulnerable @step or @remote decorator, and to execution contexts where the forged payload can be injected into the pipeline trigger mechanism.

The provided CVSS 4.0 score of 8.5 uses PR:H, implying a high-privilege attacker, yet the description names only 'authenticated remote user' with access to DescribePipeline - a permission commonly granted to data scientists and ML engineers in shared AWS accounts, suggesting PR:L is the more representative attacker bar. This discrepancy should be verified with the vendor. The subsequent-system impacts (SC:H/SI:H/SA:H) accurately reflect that a forged payload executes in another user's pipeline context, potentially reading their data and corrupting their outputs. No EPSS data was provided; given the AWS-account-scoped threat model, opportunistic mass exploitation is unlikely. No public exploit code exists and KEV status is not confirmed. Real-world risk is most acute in multi-user or shared AWS accounts where pipeline isolation between principals is an assumed security boundary, such as enterprise ML platforms or SageMaker Studio domains with multiple data science teams.

A data scientist in a shared AWS SageMaker Studio domain uses standard AWS CLI credentials to call DescribePipeline against a colleague's active pipeline; the returned JSON definition contains the cleartext HMAC key. The attacker crafts a malicious Python payload, signs it with the extracted key to satisfy the SDK integrity check, and submits it so the pipeline invokes attacker-controlled code under the victim's execution role, potentially reading the victim's training data or exfiltrating model artifacts.