CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK
Amazon SageMaker ยท 2026-10-21
Actions
Technical Details
| Affected Versions | v3 < v3.11.0, v2 < v2.256.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-83551 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update Amazon SageMaker Python SDK to version 3.11.0 or 2.256.0 to address the HMAC key storage vulnerability, and redeploy existing pipelines using the updated SDK to replace stored symmetric keys with asymmetric public keys.
For Platform Teams
Adopt the updated Amazon SageMaker Python SDK to enhance the security of AI/ML pipelines by replacing symmetric HMAC signing with asymmetric ECDSA signing, reducing the risk of unauthorized code execution.
For Executives
Implement the latest Amazon SageMaker Python SDK updates to mitigate the risk of unauthorized code execution and protect the integrity of serialized function payloads, ensuring secure AI/ML pipeline operations.
Source
Related Amazon SageMaker Updates
- Amazon SageMaker AI announces training session APIs for serverless model customization (2026-10-22)
- Announcing new ways to customize models with SageMaker AI, without managing GPUs (2026-10-22)
- Amazon SageMaker AI now supports serverless model customization for Muse Glimmer, Qwen 3.8 and Ministral 3 models (2026-10-22)
- Beam model by Reflection is now available on Amazon SageMaker JumpStart and AWS Trainium (2026-10-21)
- CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() (2026-10-21)