CVE-2026-83551

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-69418

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +30 more potentially affected by CVE-2026-83551 via sagemaker (>=1.52.1, <=2.254.1)

sagemaker PYPI version =1.52.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =0.2.8, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-83551 Source advisory: MEND:CVE-2026-83551...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (>=1.3.14, <=1.3.18) potentially affected by CVE-2026-83551 via sagemaker (3.5.0)

sagemaker PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge =1.3.14, =1.3.18 Source cves: CVE-2026-83551 Source advisory: MEND:CVE-2026-83551...

CVE-2026-83551: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

PT-2026-84375

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.7), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73417 via jupyterlab (>=4.6.0a5, <=4.6.1)

jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73417 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233306...

amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.7), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73416 via jupyterlab (>=4.6.0a5, <=4.6.1)

jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73416 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233217...

amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.7), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73626 via jupyterlab (>=4.6.0a5, <=4.6.1)

jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73626 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233207...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20231219) +18 more potentially affected by CVE-2026-8596 via sagemaker (>=2.199.0, <=2.254.1)

sagemaker PYPI version =2.199.0, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.0, =0.1.1, =0.9.0, =2.1.0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.4.6, =0.4.0, =0.0.9, =0.0.10 and more Source cves: CVE-2026-8596 Source advisory: OSV:PYSEC-2026-3059...

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

SummaryAmazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

PYSEC-2026-3059 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (>=1.3.14, <=1.3.18) potentially affected by CVE-2026-8597 via sagemaker (3.5.0)

sagemaker PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge =1.3.14, =1.3.18 Source cves: CVE-2026-8597 Source advisory: OSV:PYSEC-2026-3060...

Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

SummaryAmazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

PYSEC-2026-3060 Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20231219) +18 more potentially affected by CVE-2026-8597 via sagemaker (>=2.199.0, <=2.254.1)

sagemaker PYPI version =2.199.0, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.0, =0.1.1, =0.9.0, =2.1.0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.4.6, =0.4.0, =0.0.9, =0.0.10 and more Source cves: CVE-2026-8597 Source advisory: OSV:PYSEC-2026-3060...