CVE-2026-83551— Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
Quick assessment
Affected
AWS sagemaker-python-sdk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Amazon SageMaker Python SDK 的 和 装饰器管道组件中，v3.11.0 之前以及 v2.256.0 之前，敏感信息以明文形式存储。这可能导致已认证的远程用户从 SageMaker API 的响应中提取 HMAC 签名密钥，并为精心构造的函数载荷伪造有效的完整性签名，从而在同一 AWS 账户内的其他用户的管道执行上下文中实现代码执行。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1210 · Exploitation of Remote Services T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-83551
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
Source: CVE Program / CVE List V5
Vulnerability Description
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | sagemaker-python-sdk | 0 ~ 3.11.0 | - |
|
II. Public POCs for CVE-2026-83551
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-83551
请登录查看更多情报信息。
Other References for CVE-2026-83551 (3)
IV. Related Vulnerabilities
Same vendor: AWS
-
CVE-2026-81838
Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac -
CVE-2026-77811
Stored Cross-Site Scripting via Integration Template Asset i -
CVE-2026-77810
Code Injection via Gremlin Query Passthrough in Amazon Athen -
CVE-2026-18420
RCE via Prototype Pollution in OpenSearch Dashboards -
CVE-2026-75910
Incorrect privilege assignment in the Amazon aws-athena-quer
Same weakness: CWE-312
-
CVE-2026-77975
Ebyte NA111-M Cleartext Storage of Sensitive Information -
CVE-2026-82699
sambitraj Student Management System Password aca.sql clearte -
CVE-2026-82640
browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Sto -
CVE-2026-77970
Sensitive fields nested in embedded values are not redacted -
CVE-2026-75847
Sensitive attribute values stored in a non-sensitive public
V. Comments for CVE-2026-83551
No comments yet