Skip to main content

Cleartext Transmission of Sensitive Information

CVE-2026-1777

High
8.5/10

Summary

The Amazon SageMaker Python SDK versions prior to 2.256.0 and 3.x prior to 3.2.0, sagemaker-mlops versions prior to 1.2.0, and sagemaker-core versions prior to 2.2.0 includes the "ModelBuilder" HMAC signing key in the cleartext response elements of the "DescribeTrainingJob()" function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-319 - Cleartext Transmission of Sensitive Information

The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References

Advisory Timeline

  • Published