CVE-2025-0508: AWS SageMaker Python SDK Hash Collision

CVE-2025-0508 Overview

CVE-2025-0508 affects the SageMaker Workflow component of the aws/sagemaker-python-sdk library. The vulnerability stems from the use of MD5, a cryptographically broken hash algorithm, to fingerprint workflow objects and files. Because MD5 is susceptible to collisions, two distinct workflow configurations can produce identical hash values. This causes the SDK to reuse cached results from a different configuration, silently replacing one workflow with another. The result is a pipeline integrity failure that can produce incorrect processing outcomes without warning to the operator. All versions prior to the patched release are affected. The weakness is classified under CWE-328: Use of Weak Hash.

Critical Impact
Attackers who can influence workflow inputs may craft MD5-colliding configurations that cause SageMaker pipelines to reuse the wrong cached results, corrupting machine learning pipeline integrity.

Affected Products

aws/sagemaker-python-sdk — all versions prior to the fix commit dcdd99f
Amazon SageMaker Python SDK Workflow (Pipelines) component
Downstream ML pipelines that rely on hash_object or hash_file in src/sagemaker/workflow/utilities.py

Discovery Timeline

2025-03-20 - CVE-2025-0508 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0508

Vulnerability Analysis

The SageMaker Python SDK uses hash values to identify workflow steps and file artifacts. When two inputs produce the same hash, the SDK treats them as equivalent and reuses previously computed results. The original implementation relied on MD5, which has documented collision attacks that allow adversaries to construct distinct inputs with identical digests. In a SageMaker Pipeline, this permits a step configuration to be replaced by cached output that was produced under different parameters. The failure is silent because the SDK does not detect the collision and proceeds as if the cached step were valid. Downstream training, processing, or inference stages then consume tainted or incorrect intermediate results.

Root Cause

The root cause is the selection of hashlib.md5 for object and file fingerprinting in src/sagemaker/workflow/utilities.py. MD5 does not provide collision resistance and is inappropriate for any integrity-sensitive identifier. The hash_object and hash_file functions used MD5 to derive workflow identifiers that were later relied upon as unique keys.

Attack Vector

An attacker with the ability to influence workflow inputs, uploaded files, or configuration objects can craft a colliding input that maps to the hash of an existing cached step. When the pipeline runs, the SDK reuses the cached result instead of executing the intended step, corrupting pipeline integrity. The attack requires the ability to submit or influence pipeline definitions and depends on MD5 collision generation, which is computationally feasible but non-trivial.

python

# Security patch: src/sagemaker/workflow/utilities.py
# Replaces MD5 with SHA-256 for workflow object and file hashing

def hash_object(obj) -> str:
    """Get the SHA256 hash of an object.

    Args:
        obj (dict): The object
    Returns:
        str: The SHA256 hash of the object
    """
    return hashlib.sha256(str(obj).encode()).hexdigest()


def hash_file(path: str) -> str:
    """Get the SHA256 hash of a file.

    Args:
        path (str): The local path for the file.
    Returns:
        str: The SHA256 hash of the file.
    """
    return _hash_file(path, hashlib.sha256()).hexdigest()

# Source: https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864

Detection Methods for CVE-2025-0508

Indicators of Compromise

Unexpected reuse of cached pipeline steps despite changed input configurations or parameters
SageMaker Pipeline execution logs showing identical step hashes for configurations that should differ
ML model outputs that deviate from expected results without corresponding code changes

Detection Strategies

Audit the installed version of sagemaker-python-sdk in build environments, notebooks, and CI/CD pipelines and flag any version predating commit dcdd99f
Inspect pipeline step definitions and cached artifacts for MD5-length (32-character) hash identifiers, which indicate the pre-patch code path
Compare pipeline step inputs against cached outputs to identify cases where distinct configurations produced the same identifier

Monitoring Recommendations

Enable AWS CloudTrail logging for SageMaker Pipeline API calls and monitor for anomalous step reuse patterns
Track dependency versions in software bills of materials (SBOMs) and alert on installations of vulnerable sagemaker-python-sdk releases
Log and review the outputs of ML training and processing jobs for statistical deviation from baseline expectations

How to Mitigate CVE-2025-0508

Immediate Actions Required

Upgrade sagemaker-python-sdk to the patched release that includes commit dcdd99f
Invalidate and regenerate cached pipeline step results produced under the vulnerable MD5-based hashing scheme
Review pipeline definitions accepting untrusted or externally sourced inputs and re-run affected workflows

Patch Information

AWS resolved the vulnerability by replacing hashlib.md5 with hashlib.sha256 in src/sagemaker/workflow/utilities.py. The fix is available in commit dcdd99f911e8b1a05d19cf1ad939b0fefae47864. See the Huntr disclosure report for additional technical background.

Workarounds

Restrict who can submit or modify SageMaker Pipeline definitions to trusted users only
Disable pipeline step caching for workflows that process untrusted inputs until the patched SDK version is deployed
Pin sagemaker-python-sdk to the patched version in requirements.txt, pyproject.toml, or equivalent dependency manifests

bash

# Upgrade to the patched SageMaker Python SDK
pip install --upgrade sagemaker

# Verify installed version
pip show sagemaker | grep -i version