AWS SageMaker Python SDK vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting AWS SageMaker Python SDK: 2 record(s), with affected versions and fixes.
CVE-2026-110248
Medium · 5.3
CWE-532 Oct 14, 2026
Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output.
To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
CVE-2026-83551
High · 7.2
CWE-312 Sep 1, 2026
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.