High severity · published Sep 1, 2026
CVE-2026-83551
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
7.2
CVSS
0.8%
EPSS
No
On KEV
Description
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
sagemaker-python-sdk · AWS
before 3.11.0; before 2.256.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-83551
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-83551
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-093-aws/
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.11.0
github.com
https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7xmc-crrw-fv5r
More from sagemaker-python-sdk
5.3
CVE-2026-110248
Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py