8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1777

CVE-2026-1777: Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1777

CVE-2026-1777:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sagemaker	pip	>= 3.0, < 3.2.0	3.2.0
sagemaker	pip	< 2.256.0	2.256.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the exposure of an HMAC secret key used for verifying the integrity of serialized Python objects stored in S3. The root cause is that the secret key was stored as an environment variable (REMOTE_FUNCTION_SECRET_KEY) within the SageMaker training job. This environment variable is visible to anyone with DescribeTrainingJob API permissions.

The patches address this by removing the HMAC-based integrity check entirely. The hmac_key parameter was removed from all serialization and deserialization functions, and the key is no longer generated or stored in the job's environment variables. Instead of HMAC-SHA256, the new implementation uses a simple SHA256 hash of the payload for the integrity check, which does not rely on a secret key.

The primary vulnerable functions are those responsible for deserialization (deserialize_obj_from_s3, deserialize_func_from_s3), as they are the entry point for remote code execution if an attacker can provide a malicious object signed with the compromised key. The functions that expose the key (_Job.from_describe_response) or set the key in the environment (_JobSettings.__init__, _Job.compile) are the enablers of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.