EUVD-2026-30423
GHSA-rq6v-x3j8-7qgf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5Blast Radius
ecosystem impact- 4 pypi packages depend on sagemaker (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.199.0.
DescriptionCVE.org
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.
To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.
AnalysisAI
Remote authenticated actors with S3 write access can achieve code execution in Amazon SageMaker Triton inference containers by replacing model artifacts with malicious pickle payloads that are deserialized without integrity verification. Affected versions are SDK v2 before v2.257.2 and v3 before v3.8.0. The vulnerability requires high-privilege S3 access to the model artifact path but carries severe impact including arbitrary code execution within inference containers. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Triton inference handler within the Amazon SageMaker Python SDK, which uses Python's pickle deserialization to load model artifacts from S3 without implementing cryptographic integrity checks (HMAC or signature verification). The root cause is improper input validation and missing cryptographic controls (CWE-354: Improper Validation of Integrity Check Value), allowing an attacker who can write to S3 to inject arbitrary serialized Python objects that execute code during deserialization. This affects the ModelBuilder workflow for creating Triton models. The CPE cpe:2.3:a:amazon_sagemaker_python_sdk:aws:*:*:*:*:*:*:*:* indicates the vulnerability spans all versions of the SDK prior to the patched releases, with no platform or language restrictions.
RemediationAI
Upgrade Amazon SageMaker Python SDK to v2.257.2 or v3.8.0 immediately using pip install --upgrade sagemaker2.257.2 or sagemaker3.8.0. After upgrading, rebuild all Triton models previously created with ModelBuilder using the updated SDK to ensure models are serialized with the new integrity checks in place. No workarounds exist for older versions - patching is the only mitigation. Verify S3 access controls to ensure only authorized service roles and privileged users can write to model artifact paths; use bucket policies and IAM role restrictions to limit write access. Inspect CloudTrail logs for S3 PutObject operations on model artifacts to detect unauthorized modifications. References: https://aws.amazon.com/security/security-bulletins/2026-031-aws/ and https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Share
External POC / Exploit Code
Leaving vuln.today