CVE-2026-1777

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output...

CVE-2026-1777

The CVE-2026-1777 issue affects the Amazon SageMaker Python SDK prior to v3.2.0 and v2.256.0, where the ModelBuilder HMAC signing key is exposed in cleartext within DescribeTrainingJob responses. A privileged attacker who can both call DescribeTrainingJob and modify objects in the Training Jobs S...