Vulnerability in sagemaker (CVE-2026-8597)
Summary
Vulnerability in sagemaker (CVE-2026-8597). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 3.8.0 or later.
Original description
The description as published by the source.
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.
To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-8597 has been found in sagemaker.
Successful exploitation can lead to full system takeover. CVSS score: 7.2/10.
What to do: upgrade sagemaker to 3.8.0 or later.
If unsure, ask your IT team or search "sagemaker CVE-2026-8597" on the vendor's site.
CVE-2026-8597 (sagemaker) — CWE-354 / CVSS v3 7.2
Attack vector: remote (network-reachable) / no user interaction
Patched: 3.8.0 — apply immediately
Workaround: If upgrading is not immediately possible, users should restrict S3 write access to model artifact paths to only trusted principals and monitor for unintended modifications to files in model artifact S3 locations.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-354) exists in sagemaker.
Check the vendor advisory for the affected versions of sagemaker.
Severity: High (CVSS 7.2/10). Successful exploitation can lead to full system takeover.
Update to 3.8.0.
Workaround: If upgrading is not immediately possible, users should restrict S3 write access to model artifact paths to only trusted principals and monitor for unintended modifications to files in model artifact S3 locations.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'sagemaker' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'sagemaker' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
sagemakerを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
If upgrading is not immediately possible, users should restrict S3 write access to model artifact paths to only trusted principals and monitor for unintended modifications to files in model artifact S3 locations.パッチが適用されるまでの応急処置として、If upgrading is not immediately possible, users should restrict S3 write access to model artifact paths to only trusted principals and monitor for unintended modifications to files in model artifact S3 locations. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade sagemaker to 3.8.0ステージング環境で 3.8.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory aws.amazon.com
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- patch github.com
- web aws.amazon.com
- web github.com