PT-2026-42603

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

mdbt (>=0.5.1 <=0.6.0), sqlfluff-templater-dataform (>=0.1.8 <=0.1.12) +2 more potentially affected by CVE-2026-46374 via sqlfluff (>=4.0.0 <=4.1.0)

sqlfluff PYPI version =4.0.0, =0.5.1, =0.1.8, =4.0.0, =4.1.0 - stylebook =0.1.0 Source cves: CVE-2026-46374 Source advisory: SNYK:PYTHON-SQLFLUFF-16770152...

CVE-2026-8596 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for special...