CVE-2026-1777highCWE-319

CVE-2026-1777: high-severity vulnerability in AWS SageMaker Python SDK

Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

Published · Updated

Follow this CVE+ Monitor sagemaker-python-sdk+ Monitor sagemaker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.5%
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Affected products
AWS · SageMaker Python SDK
Related CVEs — AWS SageMaker Python SDK

In the same product, most dangerous first.

CVE-2026-110248MEDIUMInsertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]pyEPSS 0.5%CVE-2026-1778HIGHTLS disabled by default in select aws/sagemaker-python-sdk configurationsEPSS 0.3%