High severity · published May 14, 2026
CVE-2026-8597
Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.
To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Amazon SageMaker Python SDK · AWS
2.199.0 through 2.257.1; 3.0.0 through 3.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8597
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-031-aws/
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2
github.com
https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0
github.com
https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rq6v-x3j8-7qgf
More from Amazon SageMaker Python SDK
8.1
CVE-2026-112408
Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
7.2
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path