{"data":{"id":"9ebaf350-e842-437f-8a84-6ed87c07b24b","title":"CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK","summary":"CVE-2026-83551 affects the HMAC configuration in the SageMaker Python SDK, which the @step and @remote decorator pipeline component uses to protect serialized function payloads stored in S3. The HMAC secret key is stored in cleartext in pipeline definitions and is readable through the DescribePipeline API, so an account actor with permission to invoke that API can extract it, forge valid payloads, and overwrite S3 objects to run code in another user's pipeline execution context within the same AWS account. Impacted versions are SageMaker Python SDK v3 before v3.11.0 and v2 before v2.256.0.","solution":"Fixed in SageMaker Python SDK v3.11.0 and v2.256.0. Consult the referenced AWS Security Bulletin 2026-093-AWS for the most up-to-date and complete information.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-093-aws/","publishedAt":"2026-09-01T18:21:24.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain","model_poisoning"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon SageMaker","Amazon SageMaker Python SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-01T18:21:24.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}