EUVD-2026-30420
GHSA-7hh5-prp2-mfh5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 pypi packages depend on sagemaker (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.199.0.
DescriptionCVE.org
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path.
To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.
AnalysisAI
Cleartext HMAC signing key exposure in Amazon SageMaker Python SDK versions <2.257.2 and <3.8.0 enables authenticated attackers with SageMaker describe API and S3 write permissions to forge model artifact integrity signatures and achieve remote code execution in inference containers. AWS released patches in v2.257.2 and v3.8.0 with security fixes addressing Triton HMAC key exposure and missing integrity checks. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting limited exploitation activity despite high CVSS score.
Technical ContextAI
The vulnerability affects the ModelBuilder/Serve component in Amazon SageMaker Python SDK (CWE-312: Cleartext Storage of Sensitive Information). SageMaker uses HMAC (Hash-based Message Authentication Code) signing to validate the integrity of model artifacts before loading them into inference containers. The SDK improperly exposed the HMAC signing key in cleartext within SageMaker API responses when calling describe operations. This cryptographic key material should be protected as sensitive data. When compromised, attackers can forge valid HMAC signatures for malicious model artifacts, bypassing integrity validation. Model artifacts in SageMaker are serialized Python objects (typically pickled) that execute upon deserialization in inference containers, making signature forgery equivalent to arbitrary code execution. The fix in v2.257.2/v3.8.0 addresses both the key exposure and adds missing integrity checks per GitHub release notes referencing 'Triton HMAC key exposure and missing integrity check' remediation.
RemediationAI
Upgrade Amazon SageMaker Python SDK to version 2.257.2 (for v2.x users) or version 3.8.0 (for v3.x users) immediately. Official patch releases available at https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2 and https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0. CRITICAL: Upgrading the SDK alone is insufficient - AWS explicitly recommends rebuilding ALL models previously created with ModelBuilder using the updated SDK versions, as existing model artifacts may have been created with exposed HMAC keys and lack proper integrity validation. Compensating controls if immediate upgrade is not feasible: implement strict IAM policies to revoke SageMaker DescribeModel/DescribeEndpoint permissions from non-essential principals (reduces attacker pool), enable S3 bucket versioning and object lock on model artifact storage paths to detect unauthorized modifications (creates audit trail but does not prevent exploitation), restrict S3 write permissions to model artifact buckets using least-privilege SCPs and bucket policies (raises attack complexity). Trade-offs: IAM restrictions may disrupt legitimate ML workflows requiring describe access; S3 controls add operational overhead for model deployment pipelines. These mitigations only reduce attack surface and do not eliminate the underlying cryptographic key exposure - upgrading and rebuilding models remains the only complete remediation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allShare
External POC / Exploit Code
Leaving vuln.today