{"data":{"id":"9ebaf350-e842-437f-8a84-6ed87c07b24b","title":"CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK","summary":"Amazon SageMaker Python SDK stores HMAC keys (cryptographic secrets used to verify data hasn't been tampered with) in plain text in pipeline definitions, allowing users with DescribePipeline permissions to read these keys and inject malicious code into other users' pipeline executions within the same AWS account. The vulnerability affects SageMaker Python SDK v3 versions before v3.11.0 and v2 versions before v2.256.0.","solution":"Update to SageMaker Python SDK v3.11.0 or later, or update to SageMaker Python SDK v2.256.0 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-093-aws/","publishedAt":"2026-09-01T18:21:24.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon SageMaker"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-01T18:21:24.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}