Vulnerability Description
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-093-aws/
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.11.0
- https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7xmc-crrw-f
FAQ
What is CVE-2026-83551?
CVE-2026-83551 is a vulnerability with a CVSS score of 7.2 (HIGH). Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to ...
How severe is CVE-2026-83551?
CVE-2026-83551 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-83551?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.