amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (1.3.14) potentially affected by CVE-2026-8597 via sagemaker-serve (1.5.0)

sagemaker-serve PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker-serve and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge 1.3.14 Source cves: CVE-2026-8597 Source advisory:...

Improper Validation of Integrity Check Value

Overview sagemaker-serve is a SageMaker Serve package for model serving and deployment Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Triton inference handler. An attacker can execute arbitrary code with the SageMaker execution role's IAM...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (1.3.14) potentially affected by CVE-2026-8596 via sagemaker-serve (1.5.0)

sagemaker-serve PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker-serve and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge 1.3.14 Source cves: CVE-2026-8596 Source advisory:...

Cleartext Storage of Sensitive Information

Overview sagemaker-serve is a SageMaker Serve package for model serving and deployment Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the ModelBuilder/Serve component. An attacker can extract sensitive HMAC signing keys by accessing the SageMaker...

CVE-2026-8596

CVE-2026-8596: The ModelBuilder/Serve path in the Amazon SageMaker Python SDK stores the HMAC signing key in cleartext. A remote, authenticated actor with SageMaker describe API permissions and S3 write access to the model artifact path could extract the key from API responses and forge integrity...