{"data":{"id":"81a12dfb-b873-475c-87b3-a78de1b2de02","title":"CVE-2026-1778: Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made…","summary":"CVE-2026-1778 affects the Amazon SageMaker Python SDK before v3.1.1 or v2.256.0. When a Triton Python model is imported, the SDK disables TLS certificate verification for HTTPS connections the service makes, so requests with invalid and self-signed certificates succeed. The issue is classified as CWE-295 (Improper Certificate Validation) with a CVSS 4.0 score of 8.2 (HIGH) from the CNA AMZN, and NVD had not yet provided an assessment.","solution":"Fixed in v3.1.1 and v2.256.0 of the Amazon SageMaker Python SDK.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-1778","publishedAt":"2026-02-03T04:16:04.283Z","cveId":"CVE-2026-1778","cweIds":["CWE-295"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["sagemaker@>= 3.0, < 3.1.1 (fixed: 3.1.1)","sagemaker@< 2.256.0 (fixed: 2.256.0)"],"affectedPackageNames":["sagemaker"],"affectedPackageRefs":["pypi:sagemaker"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon SageMaker","SageMaker Python SDK","Triton Python model"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Amazon SageMaker Python SDK TLS certificate verification disabled","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0026,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-62rc-f4v9-h543"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:05.719Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-11T07:56:02.408Z","daysToFix":-54,"fixCheckedAt":"2026-10-29T21:41:54.031Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"sagemaker","fixedVersion":"2.256.0","matchedVersion":"2.256.0","fixReleasedAt":"2026-01-08T21:21:00.825Z","daysToFix":-26,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:41:53.882Z"},{"ecosystem":"pypi","name":"sagemaker","fixedVersion":"3.1.1","matchedVersion":"3.1.1","fixReleasedAt":"2025-12-11T07:56:02.408Z","daysToFix":-54,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:41:53.882Z"}]}}