CVE-2026-1777

What it actually does

The vulnerable Amazon SageMaker Python SDK exposes the ModelBuilder HMAC signing key in cleartext within DescribeTrainingJob response elements. An attacker who already has permissions to call DescribeTrainingJob and write to the S3 output location used by the training job can recover the signing key, tamper with or replace artifacts in that S3 location, and cause malicious artifacts to be trusted and executed when the affected training job workflow is invoked again. The issue is a credential exposure flaw with a high-privilege prerequisite rather than a remotely exploitable unauthenticated vulnerability.

Why it matters to the business

Successful exploitation can compromise machine-learning training pipelines, allowing unauthorized code or model artifacts to run inside SageMaker workflows. This can lead to model poisoning, theft or alteration of training outputs, exposure of data processed by training jobs, disruption of ML operations, and loss of trust in generated models or artifacts. The vulnerability is not listed in CISA KEV, has low EPSS, and has no known public exploit maturity, but it has been public for months and should be remediated in environments that use SageMaker ModelBuilder or automated training-job artifact reuse.

How an attack unfolds

An attacker first obtains AWS permissions sufficient to call the SageMaker DescribeTrainingJob API for a target training job. In vulnerable SDK versions, the response can include the ModelBuilder HMAC signing key in cleartext. The attacker then identifies the S3 output location associated with the training job and uses separate write permissions to modify or upload artifacts there. By crafting artifacts that validate with or abuse the exposed signing material, the attacker positions malicious content in the training job output path. When the training job or dependent workflow is invoked again and consumes those artifacts, the attacker-controlled artifact may be executed, resulting in code execution or pipeline compromise within the permissions and runtime context of the SageMaker workflow.

How to fix it

Upgrade the Amazon SageMaker Python SDK to a fixed release: v3.2.0 or later for the v3 line, or v2.256.0 or later for the v2 line. For source-based deployments, update to a version containing commit 36fd82f05e7549df398596f83bcdf9710eef1e54 or later. Rebuild notebooks, containers, CI images, training pipelines, and dependency lockfiles that package the vulnerable SDK. Rotate any ModelBuilder HMAC signing material that may have been exposed through DescribeTrainingJob responses. Review and harden IAM permissions so only tightly scoped roles can call DescribeTrainingJob and write to SageMaker training output S3 locations. Restrict S3 write access to training output prefixes, enable S3 object versioning where feasible, and require artifact integrity controls in ML pipelines.

How to confirm the fix worked

Confirm installed SDK versions with package inventory, dependency lockfiles, notebook kernels, training images, and CI build manifests, ensuring sagemaker is v3.2.0 or later, or v2.256.0 or later. For source builds, confirm the deployed code includes commit 36fd82f05e7549df398596f83bcdf9710eef1e54 or a later fixed revision. Re-run dependency scans against all ML development and runtime images. Validate IAM policy changes by confirming ordinary user or automation roles cannot both call DescribeTrainingJob and write to the same training job S3 output prefixes unless explicitly required. Review CloudTrail to ensure DescribeTrainingJob responses are no longer exposing sensitive signing material in client-side logs, application logs, notebooks, or debug traces.

Typical attack path

1. Gain or already possess AWS credentials with permission to call SageMaker DescribeTrainingJob on target training jobs.
2. Call DescribeTrainingJob and inspect the response for cleartext ModelBuilder HMAC signing material exposed by the vulnerable SDK behavior.
3. Identify the S3 output location associated with the training job.
4. Use S3 write permissions to upload, overwrite, or modify artifacts in the training job output location.
5. Wait for or trigger a subsequent workflow invocation that consumes the modified artifacts.
6. Achieve execution of attacker-controlled artifacts in the SageMaker training or model-building workflow context.

How to detect it

Investigate CloudTrail management events for SageMaker DescribeTrainingJob calls, especially by unusual principals, from unusual IP addresses, or occurring shortly before S3 writes to the same job's output location. Correlate these with S3 data events such as PutObject, CopyObject, CompleteMultipartUpload, DeleteObject, or object overwrite activity against SageMaker training output buckets and prefixes. Review S3 object version history for unexpected artifact replacements, new executable files, modified model archives, or changes made outside normal pipeline automation. Check SageMaker training job logs, pipeline execution logs, notebook logs, and container logs for execution of unexpected artifacts, abnormal import paths, shell commands, network callbacks, or failures immediately after consuming modified output artifacts. Search application and notebook logs for cleartext signing key material or debug dumps of DescribeTrainingJob responses, because exploitation may begin with captured API responses. Review IAM activity for principals that combine SageMaker describe permissions with S3 write access to training output locations. There are no widely reported public exploitation indicators, known threat actors, or ransomware use for this vulnerability, so detection should focus on behavioral correlation rather than fixed malware signatures.

• eventName=DescribeTrainingJob
• sagemaker:DescribeTrainingJob
• DescribeTrainingJob
• eventSource=sagemaker.amazonaws.com
• eventName=PutObject
• eventName=CopyObject
• eventName=CompleteMultipartUpload
• eventName=DeleteObject
• eventSource=s3.amazonaws.com
• x-amz-copy-source
• ModelBuilder
• HMAC
• sagemaker-python-sdk
• sagemaker==2.255
• sagemaker==2.255.0
• sagemaker<2.256.0
• sagemaker<3.2.0
• 36fd82f05e7549df398596f83bcdf9710eef1e54

What your security team should do

• Prioritize upgrade of Amazon SageMaker Python SDK in notebooks, training containers, pipeline build images, and automation environments to v3.2.0 or later, or v2.256.0 or later.
• Identify principals that can both call sagemaker:DescribeTrainingJob and write to SageMaker training output S3 prefixes; remove or split these permissions where possible.
• Rotate any ModelBuilder HMAC signing keys or related signing material that may have been exposed while vulnerable SDK versions were in use.
• Enable or review CloudTrail management events for SageMaker and S3 data events for training output buckets to support retrospective investigation.
• Inspect recent S3 object changes in SageMaker training output locations, especially overwrites or uploads by unusual principals shortly after DescribeTrainingJob calls.
• Rebuild and redeploy long-lived notebook images, CI runners, and training images because dependency upgrades in source repositories alone may not update already-built runtimes.
• Use S3 object versioning, least-privilege bucket policies, and artifact integrity verification to reduce the blast radius of future pipeline artifact tampering.