Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597)
Amazon SageMaker Β· 2026-10-19
Actions
Technical Details
| Affected Versions | v2.199.0 to v2.257.1, v3.0.0 to v3.7.1 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-8596, CVE-2026-8597 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update Amazon SageMaker Python SDK to versions v2.257.2 or v3.8.0 to address security vulnerabilities (CVE-2026-8596 and CVE-2026-8597) and rebuild models created with affected versions to remove the HMAC key from container environment variables.
For Platform Teams
Adopt the updated Amazon SageMaker Python SDK to enhance the security posture of machine learning model deployments by ensuring proper integrity verification of model artifacts and preventing unauthorized code execution.
For Executives
Implement the latest Amazon SageMaker Python SDK to mitigate security risks associated with model artifact integrity verification and prevent potential code execution in inference containers, ensuring the safety and reliability of machine learning deployments.
Source
Related Amazon SageMaker Updates
- Introducing Reflection Beam: an open-weight model for agentic coding on AWS (2026-10-16)
- Beam model by Reflection is now available on Amazon SageMaker JumpStart and AWS Trainium (2026-10-16)
- Nemotron 3.5 Super VL model now available on Amazon SageMaker JumpStart (2026-10-16)
- Metaβs Muse Spark Open now available in Amazon SageMaker JumpStart (2026-10-15)
- Muse Spark Open model now available on Amazon SageMaker JumpStart (2026-10-15)