amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +29 more potentially affected by CVE-2026-1778 via sagemaker (>=2.16.1, <=2.254.1)

sagemaker PYPI version =2.16.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =1.0.0, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1778 Source advisory: SNYK:PYTHON-SAGEMAKER-15182756...

Missing Validation of OpenSSL Certificate

Overview sagemaker is an Open source library for training and deploying models on Amazon SageMaker. Affected versions of this package are vulnerable to Missing Validation of OpenSSL Certificate via the global disabling of SSL certificate verification in the Triton Python backend. An attacker in a...

GHSA-62RC-F4V9-H543 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +29 more potentially affected by CVE-2026-1778 via sagemaker (>=2.16.1, <=2.254.1)

sagemaker PYPI version =2.16.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =1.0.0, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1778 Source advisory: GHSA-62RC-F4V9-H543...

CVE-2026-1777

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +30 more potentially affected by CVE-2026-1778 via sagemaker (>=1.52.1, <=2.254.1)

sagemaker PYPI version =1.52.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =0.2.8, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1778 Source advisory: MEND:CVE-2026-1778...

CVE-2026-1777 Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +30 more potentially affected by CVE-2026-1777 via sagemaker (>=1.52.1, <=2.254.1)

sagemaker PYPI version =1.52.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =0.2.8, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1777 Source advisory: MEND:CVE-2026-1777...

CVE-2026-1777

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

CVE-2026-1777 Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

PT-2026-6479

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where the HMAC secret key is stored in environment variables and disclosed via the DescribeTrainingJob API has been identified. Impact - Function and Payload...

PT-2026-5709

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 3.1.1 Amazon SageMaker Python SDK versions prior to 2.256.0 Description The SageMaker Python SDK has an issue where TLS certificate verification is disabled for HTTPS connections when importing a...

CVE-2026-1777: Cleartext Transmission of Sensitive Information

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

CVE-2026-1778: Improper Certificate Validation

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

PT-2026-5708

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 3.2.0 Amazon SageMaker Python SDK versions prior to 2.256.0 Description The Amazon SageMaker Python SDK contains the ModelBuilder HMAC signing key in cleartext within the response elements of the...

Amazon SageMaker Python SDK security vulnerabilities

Amazon SageMaker Python SDK is a development toolkit provided by Amazon, Inc., for building, training, and deploying machine learning models. Versions of the Amazon SageMaker Python SDK prior to v3.2.0 and v2.256.0 contained security vulnerabilities. These vulnerabilities stemmed from the plainte...

Amazon SageMaker Python SDK security vulnerabilities

Amazon SageMaker Python SDK is a development toolkit provided by Amazon, Inc., for building, training, and deploying machine learning models. Versions of the Amazon SageMaker Python SDK prior to v3.1.1 and v2.256.0 contained security vulnerabilities. These vulnerabilities stemmed from the disabli...