Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. sagemaker
  4. ›
  5. CVE-2026-1777

CVE-2026-1777: SageMaker Python SDK has Exposed HMAC

February 2, 2026 (updated February 3, 2026)

SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where the HMAC secret key is stored in environment variables and disclosed via the DescribeTrainingJob API has been identified.

References

  • aws.amazon.com/security/security-bulletins/2026-004-AWS
  • github.com/advisories/GHSA-rjrp-m2jw-pv9c
  • github.com/aws/sagemaker-python-sdk
  • github.com/aws/sagemaker-python-sdk/commit/708c7b2f4135ecaec55973d098f3dbe98b657933
  • github.com/aws/sagemaker-python-sdk/commit/fb0d789db4fd5fecde5509963939369f4c7ce63b
  • github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rjrp-m2jw-pv9c
  • nvd.nist.gov/vuln/detail/CVE-2026-1777

Code Behaviors & Features

Detect and mitigate CVE-2026-1777 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.256.0, all versions starting from 3.0 before 3.2.0

Fixed versions

  • 3.2.0
  • 2.256.0

Solution

Upgrade to versions 2.256.0, 3.2.0 or above.

Impact 7.2 HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-201: Insertion of Sensitive Information Into Sent Data
  • CWE-295: Improper Certificate Validation
  • CWE-319: Cleartext Transmission of Sensitive Information

Source file

pypi/sagemaker/CVE-2026-1777.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 04 Feb 2026 00:35:17 +0000.