Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 &amp: CVE-2026-8597)

Summary

Amazon SageMaker Python SDK versions >= v2.199.0 and <= v2.257.1, and >= v3.0.0 and <= v3.7.1, contain two flaws in the model artifact integrity checks of ModelBuilder/Serve, tracked as CVE-2026-8596 and CVE-2026-8597. The SDK stored an HMAC signing key as the SAGEMAKER_SERVE_SECRET_KEY container environment variable, and SageMaker describe APIs returned it in plaintext. A remote authenticated actor with those API permissions and S3 write access to the artifact path could forge signatures and run code in inference containers. The Triton inference handler also deserialized artifacts without integrity verification, letting such an actor replace them with a crafted pickle payload for code execution.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins
• CriticalCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSSame vendor · AWS Security Bulletins
• HighCVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scanSame vendor · AWS Security Bulletins
• HighGHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file writeSame vendor · GitHub Advisory Database