amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (>=1.3.14, <=1.3.18) potentially affected by CVE-2026-8596 via sagemaker (3.5.0)

sagemaker PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge =1.3.14, =1.3.18 Source cves: CVE-2026-8596 Source advisory: OSV:PYSEC-2026-3059...

PYSEC-2026-2661 MLflow has a command injection in mlflow/sagemaker/__init__.py

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...

MLflow has a command injection in mlflow/sagemaker/__init__.py

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...

PT-2026-59310

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/ init .py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization,...

PT-2026-59679

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

PT-2026-59680

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2026-1778 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2026-1778 Source advisory: OSV:PYSEC-2026-1886...

PYSEC-2026-1886 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

SageMaker Python SDK has Insecure TLS Configuration

SummarySageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. ImpactArbitrary Code Execution: Disabling SSL verification...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +29 more potentially affected by CVE-2026-1778 via sagemaker (>=2.16.1, <=2.254.1)

sagemaker PYPI version =2.16.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =1.0.0, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1778 Source advisory: OSV:PYSEC-2026-1886...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2026-1778 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2026-1778 Source advisory: OSV:PYSEC-2026-1886...

ezsmdeploy (0.2.9) potentially affected by CVE-2026-1778 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2026-1778 Source advisory: OSV:PYSEC-2026-1886...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2026-1777 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2026-1777 Source advisory: OSV:PYSEC-2026-1888...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +29 more potentially affected by CVE-2026-1777 via sagemaker (>=2.16.1, <=2.254.1)

sagemaker PYPI version =2.16.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =1.0.0, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-1777 Source advisory: OSV:PYSEC-2026-1888...

ezsmdeploy (0.2.9) potentially affected by CVE-2026-1777 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2026-1777 Source advisory: OSV:PYSEC-2026-1888...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2026-1777 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2026-1777 Source advisory: OSV:PYSEC-2026-1888...

PYSEC-2026-1885 SageMaker Workflow component allows possibility of MD5 hash collisions

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This...

SageMaker Workflow component allows possibility of MD5 hash collisions

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2025-0508 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2025-0508 Source advisory: OSV:PYSEC-2026-1885...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2025-0508 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2025-0508 Source advisory: OSV:PYSEC-2026-1885...