Amazon SageMaker Python SDK: CVE-2026-8596 Allows Code Execution
The National Vulnerability Database has detailed CVE-2026-8596, a critical vulnerability in Amazon SageMaker Python SDK versions prior to v2.257.2 and v3.8.0. This flaw, rated with a CVSS score of 7.2 (HIGH), enables remote authenticated actors to extract the HMAC signing key from SageMaker API responses. This key can then be used to forge valid integrity signatures for malicious model artifacts.
Attackers require specific permissions: the ability to call SageMaker describe APIs and S3 write access to the model artifact path. If these conditions are met, the forged artifacts can lead to arbitrary code execution within inference containers. This is a severe issue, as it directly compromises the integrity and execution environment of machine learning models.
To mitigate this, defenders must upgrade their Amazon SageMaker Python SDK to v2.257.2 or v3.8.0 immediately. Furthermore, any models previously created with ModelBuilder using an affected SDK version must be rebuilt with the updated SDK to ensure they are free from this vulnerability.
What This Means For You
- If your organization utilizes Amazon SageMaker Python SDK for machine learning model development and deployment, you are directly exposed. This isn't just a data leakage risk; it's a direct path to code execution in your inference containers. Patching the SDK isn't enough; you must rebuild existing models to remove the vulnerability from your artifacts. Prioritize this, especially for critical ML workloads.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-8596 - SageMaker SDK ModelBuilder HMAC Key Extraction
title: CVE-2026-8596 - SageMaker SDK ModelBuilder HMAC Key Extraction
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
Detects potential exploitation of CVE-2026-8596 by looking for SageMaker API describe calls that might leak HMAC signing keys. This is a critical step for an attacker to forge model artifact signatures and achieve code execution.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-8596/
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/describe'
cs-method|contains:
- 'POST'
sc-status|contains:
- '200'
cs-uri-query|contains:
- 'SageMaker'
cs-uri-query|contains:
- 'ModelBuilder'
cs-uri-query|contains:
- 'HMAC'
selection_base:
cs-uri|contains:
- '/describe'
selection_indicators:
cs-uri-query|contains:
- 'SageMaker'
cs-uri-query|contains:
- 'ModelBuilder'
cs-uri-query|contains:
- 'HMAC'
condition: selection_base AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-8596 | RCE | Amazon SageMaker Python SDK before v2.257.2 |
| CVE-2026-8596 | RCE | Amazon SageMaker Python SDK v3 before v3.8.0 |
| CVE-2026-8596 | Information Disclosure | ModelBuilder/Serve component in Amazon SageMaker Python SDK |
| CVE-2026-8596 | Code Execution | Forge valid integrity signatures for specially crafted model artifacts |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 23:17 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6811 — Stack exhaustion vulnerability in the MongoDB PHP driver
CVE-2026-6811 — Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the...
CVE-2026-45248 — The GET /Api/V1/Demo/Registered-Users Endpoint That Authentication Bypass
CVE-2026-45248 — Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information....
ZITADEL LDAP Filter Injection Exposes Usernames, Attributes
CVE-2026-44671 — ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity...