HighVulnerability

GHSA-7hh5-prp2-mfh5: Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-8596GHSA-7hh5-prp2-mfh5
Published: May 21, 2026
Record updated: October 9, 2026

Affected: sagemaker >= 3.0.0, <= 3.7.1, fixed in 3.8.0
sagemaker >= 2.199.0, <= 2.257.1, fixed in 2.257.2
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.8%

Summary

Under certain circumstances, the ModelBuilder/Serve component of Amazon SageMaker Python SDK stores an HMAC signing key in cleartext as the SAGEMAKER_SERVE_SECRET_KEY container environment variable. The DescribeModel, DescribeEndpointConfig, and DescribeModelPackage APIs return this variable in plaintext. A remote authenticated actor with describe permissions and S3 write access to the model artifact path could extract the key, forge integrity signatures for crafted model artifacts, and achieve code execution in inference containers with the SageMaker execution role's IAM permissions. Affected versions are >= v2.199.0 through <= v2.257.1, and >= v3.0.0 through <= v3.7.1.

Mitigation

Upgrade to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder, since models built with affected versions may still hold the HMAC key in their container environment variables. Patch any forked or derivative code. If upgrading is not immediately possible, manually remove the SAGEMAKER_SERVE_SECRET_KEY environment variable by recreating the model without it in the container environment configuration.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.8%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 13, 2026.
Disclosure date: May 21, 2026

Affected

Packages: sagemaker@>= 3.0.0, <= 3.7.1 (fixed: 3.8.0)
sagemaker@>= 2.199.0, <= 2.257.1 (fixed: 2.257.2)
Vendors: Amazon

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Inference
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-7hh5-prp2-mfh5

First tracked: May 21, 2026 at 02:00 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

sagemakerPyPILLM dependency since 2024-07-10 · 3 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items