CVE-2026-83551: SageMaker HMAC leak — HIGH

CISO Take

A flaw in the Amazon SageMaker Python SDK's @step and @remote decorators — the feature that lets data scientists run arbitrary Python functions as remote pipeline steps — stores the HMAC key that authenticates serialized function payloads in a way that's readable in cleartext from the DescribePipeline API response, letting any authenticated user in the same AWS account forge a valid signature and get code executed inside another user's pipeline execution context. It's rated High rather than Critical (CVSS 7.2, PR:H) because the attacker must already hold valid credentials in the target account — this isn't an internet-facing zero-click bug — but in any environment where multiple teams share SageMaker infrastructure, it collapses the isolation between pipelines and can turn a low-privilege data-science role into a path toward whatever IAM permissions the victim's pipeline execution role carries. There's no CISA KEV listing, no EPSS score, no public PoC, and no Nuclei template, so there's no evidence of active exploitation — urgency here is driven by blast radius and lateral-movement potential, not observed attacks. Teams running SageMaker Pipelines with @step/@remote decorators should upgrade to SDK v3.11.0+ or v2.256.0+, redeploy pipelines to force regeneration of signing keys, and tighten IAM policies around sagemaker:DescribePipeline and pipeline execution roles so a forged payload can't translate into meaningful privilege escalation.

Sources: NVD GitHub Advisory aws.amazon.com ATLAS

What is the risk?

CVSS 7.2 (High) reflects severe confidentiality, integrity, and availability impact once exploited, offset by the requirement for high privileges (PR:H) — the attacker must already be an authenticated principal in the target AWS account, making this a lateral-movement/privilege-escalation vector rather than an external attack surface issue. No EPSS score, no CISA KEV listing, and no public exploit code or scanner templates exist, indicating no observed in-the-wild exploitation as of publication. Practical risk is highest in AWS accounts where multiple teams or tenants share SageMaker Pipelines infrastructure using @step/@remote decorators and where pipeline execution roles carry broader permissions than individual users — the vulnerability effectively erases the intended isolation boundary between pipeline owners. Single-tenant, single-role SageMaker environments face materially lower practical risk despite the identical CVSS score.

How does the attack unfold?

Credential/Key Discovery

An authenticated user in the same AWS account calls the DescribePipeline API against a pipeline they don't own, retrieving the HMAC signing key exposed in cleartext in the response.

AML.T0055

Payload Forgery

The attacker crafts a malicious serialized Python function payload for the @step/@remote decorator and signs it with the stolen HMAC key so it passes the SDK's integrity check.

AML.T0050

Cross-Context Execution

The forged, validly-signed payload is submitted so it executes within the victim's pipeline execution role rather than the attacker's own.

AML.T0012

Privilege Escalation / Impact

Code runs with the victim pipeline execution role's permissions, giving the attacker access to training data, model artifacts, or other AWS resources beyond their original entitlement.

Credential/Key Discovery

An authenticated user in the same AWS account calls the DescribePipeline API against a pipeline they don't own, retrieving the HMAC signing key exposed in cleartext in the response.

AML.T0055

Payload Forgery

The attacker crafts a malicious serialized Python function payload for the @step/@remote decorator and signs it with the stolen HMAC key so it passes the SDK's integrity check.

AML.T0050

Cross-Context Execution

The forged, validly-signed payload is submitted so it executes within the victim's pipeline execution role rather than the attacker's own.

AML.T0012

Privilege Escalation / Impact

Code runs with the victim pipeline execution role's permissions, giving the attacker access to training data, model artifacts, or other AWS resources beyond their original entitlement.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
SageMaker	pip	—	No patch
51 dependents 86% patched ~36d to patch Full package profile →

Do you use SageMaker? You're affected.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade the sagemaker Python SDK to v3.11.0+ (v3.x branch) or v2.256.0+ (v2.x branch) immediately in any environment using @step/@remote decorators. Because the HMAC key may already be compromised, redeploy or re-create existing pipelines after upgrading so new signing keys are generated — don't assume the patch alone invalidates previously exposed keys. Audit IAM policies for sagemaker:DescribePipeline and restrict it to the minimum set of principals that need pipeline visibility, treating it as a sensitive read action going forward. Review and tighten pipeline execution role permissions under least privilege so a successful forged-payload execution has limited blast radius. For detection, monitor CloudTrail for DescribePipeline calls from unexpected principals followed by pipeline executions with anomalous step definitions, and flag executions triggered by users who aren't the pipeline's normal owner.

How is it classified?

Code Execution Auth Bypass Data Leakage API Framework AML.T0010.001 - AI Software AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Security controls for AI system components

NIST AI RMF

MANAGE 4.1 - AI system vulnerability and incident management

Frequently Asked Questions

What is CVE-2026-83551?

A flaw in the Amazon SageMaker Python SDK's @step and @remote decorators — the feature that lets data scientists run arbitrary Python functions as remote pipeline steps — stores the HMAC key that authenticates serialized function payloads in a way that's readable in cleartext from the DescribePipeline API response, letting any authenticated user in the same AWS account forge a valid signature and get code executed inside another user's pipeline execution context. It's rated High rather than Critical (CVSS 7.2, PR:H) because the attacker must already hold valid credentials in the target account — this isn't an internet-facing zero-click bug — but in any environment where multiple teams share SageMaker infrastructure, it collapses the isolation between pipelines and can turn a low-privilege data-science role into a path toward whatever IAM permissions the victim's pipeline execution role carries. There's no CISA KEV listing, no EPSS score, no public PoC, and no Nuclei template, so there's no evidence of active exploitation — urgency here is driven by blast radius and lateral-movement potential, not observed attacks. Teams running SageMaker Pipelines with @step/@remote decorators should upgrade to SDK v3.11.0+ or v2.256.0+, redeploy pipelines to force regeneration of signing keys, and tighten IAM policies around sagemaker:DescribePipeline and pipeline execution roles so a forged payload can't translate into meaningful privilege escalation.

Is CVE-2026-83551 actively exploited?

No confirmed active exploitation of CVE-2026-83551 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-83551?

Upgrade the sagemaker Python SDK to v3.11.0+ (v3.x branch) or v2.256.0+ (v2.x branch) immediately in any environment using @step/@remote decorators. Because the HMAC key may already be compromised, redeploy or re-create existing pipelines after upgrading so new signing keys are generated — don't assume the patch alone invalidates previously exposed keys. Audit IAM policies for sagemaker:DescribePipeline and restrict it to the minimum set of principals that need pipeline visibility, treating it as a sensitive read action going forward. Review and tighten pipeline execution role permissions under least privilege so a successful forged-payload execution has limited blast radius. For detection, monitor CloudTrail for DescribePipeline calls from unexpected principals followed by pipeline executions with anomalous step definitions, and flag executions triggered by users who aren't the pipeline's normal owner.

What systems are affected by CVE-2026-83551?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, MLOps pipelines.

What is the CVSS score for CVE-2026-83551?

CVE-2026-83551 has a CVSS v3.1 base score of 7.2 (HIGH).

What is the AI security impact?

Affected AI Architectures

training pipelinesMLOps pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Exploitation Scenario

An attacker with authenticated but limited SageMaker access (e.g., a data-science IAM role with sagemaker:DescribePipeline permission) in a shared AWS account targets a pipeline they don't own that uses @step/@remote decorators. They call DescribePipeline against that pipeline and extract the HMAC signing key returned in cleartext in the response. They then craft a malicious serialized Python function payload — for example one that exfiltrates data or opens a reverse shell — sign it with the stolen HMAC key so it passes the integrity check, and get it executed within the victim pipeline's execution context. Because that execution role may hold broader IAM permissions than the attacker's own role, the attacker effectively escalates privileges and gains access to training data, models, or other AWS resources beyond their original entitlement.

Weaknesses (CWE)

CWE-312 Cleartext Storage of Sensitive Information

CWE-312 — Cleartext Storage of Sensitive Information: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

[Implementation, System Configuration, Operation] When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
[Implementation, System Configuration, Operation] In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Source: MITRE CWE corpus.