AWS SageMaker Python SDK HMAC Key Disclosure and TLS Verification Bypass (CVE-2026-1777/1778)

Critical Vulnerability Information Advisory Advisory ID: 2026-004-AWS Affected Scope: AWS Content Type: Important (Requires Attention) Release Date: February 2, 2026, at 12:15 PM PST CVE Identifiers CVE-2026-1777: Exposed HMAC in SageMaker Python SDK CVE-2026-1778: Insecure TLS Configuration in SageMaker Python SDK Description CVE-2026-1777: The remote function feature in the SageMaker Python SDK uses per-job HMAC keys to protect the integrity of serialized functions, parameters, and results stored. It has been discovered that the HMAC key is stored in environment variables and disclosed via the DescribeTrainingJob API. Third parties with DescribeTrainingJob permissions can extract the key, forge valid payloads with valid HMACs, and overwrite S3 objects. CVE-2026-1778: The SageMaker Python SDK is an open-source library used for training and deploying machine learning models on Amazon SageMaker. SSL certificate verification is globally disabled in the Triton Python backend. This configuration was implemented to resolve SSL errors when downloading models from public sources (e.g., TorchVision), but it affects all HTTPS connections during Triton Python model imports. Affected Versions HMAC configuration in SageMaker Python SDK v3 < v3.2.0 HMAC configuration in SageMaker Python SDK v2 < v2.256.0 References CVE-2026-1777 CVE-2026-1778 GHSA-rjrpmzjw-pv9c GHSA-62rc-f4y9-h543 Note: For any security concerns or questions, please email aws-security@amazon.com

Goal Reached Thanks to every supporter — we hit 100%!

AWS SageMaker Python SDK HMAC Key Disclosure and TLS Verification Bypass (CVE-2026-1777/1778)