CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK

CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK

Bulletin ID: 2026-093-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/01/2026 11:00 AM PDT

SageMaker Python SDK's @step and @remote decorator pipeline component uses an HMAC key to protect the integrity of serialized function payloads stored in S3. We identified an issue where the HMAC secret key is stored in cleartext within pipeline definitions and accessible via the DescribePipeline API.

This allows an actor with a role in that account that has permissions to invoke DescribePipeline to extract the key, create cloud-pickled payloads with valid HMACs, and overwrite S3 objects, achieving code execution in another user's pipeline execution context within the same AWS account.

This issue has been addressed in Amazon SageMaker Python SDK version 3.11.0 (v3) and 2.256.0 (v2). The v3 fix replaces symmetric HMAC signing with asymmetric ECDSA signing, ensuring only the private key (which remains on the client) can generate valid signatures. The v2 fix removes the stored key entirely. We recommend upgrading to the latest version and updating the existing pipeline definitions created via @step decorator (e.g., calling pipeline.upsert()) with the updated SDK. This replaces the stored symmetric HMAC key with an asymmetric public key, ensuring previously registered pipelines are no longer exposed. For @remote decorator users, upgrading the SDK is sufficient, no additional action is required as each invocation creates a fresh job with no persisted key material.

Customers who cannot immediately upgrade should restrict sagemaker:DescribePipeline IAM permissions to only trusted users within the account, and configure a dedicated per-user s3_root_uri for @remote/@step decorator workloads to isolate serialized payloads.