CVE-2026-1778: SageMaker Python SDK TLS Vulnerability

CVE-2026-1778 Overview

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 contains an Improper Certificate Validation vulnerability (CWE-295) that disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported. This flaw incorrectly allows requests with invalid and self-signed certificates to succeed, potentially enabling man-in-the-middle (MITM) attacks against machine learning workflows.

Critical Impact

Attackers positioned on the network path can intercept and manipulate HTTPS traffic during Triton model imports, potentially injecting malicious model artifacts or exfiltrating sensitive training data without triggering certificate validation errors.

Affected Products

• Amazon SageMaker Python SDK versions prior to v3.1.1 (v3.x branch)
• Amazon SageMaker Python SDK versions prior to v2.256.0 (v2.x branch)
• Deployments using Triton Python model imports over HTTPS

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-1778 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-1778

Vulnerability Analysis

This vulnerability stems from improper certificate validation in the Amazon SageMaker Python SDK when handling HTTPS connections during Triton Python model imports. When the SDK retrieves model artifacts or communicates with remote endpoints during the import process, it fails to properly validate TLS certificates, effectively trusting any certificate presented by the server—including self-signed, expired, or otherwise invalid certificates.

The impact of this vulnerability is significant for integrity, as it allows network-positioned attackers to perform man-in-the-middle attacks. In machine learning pipelines, this could result in the injection of backdoored or poisoned models, manipulation of inference results, or unauthorized access to proprietary model architectures and training data transmitted over what users expect to be secure channels.

Root Cause

The root cause is classified as CWE-295 (Improper Certificate Validation). The SDK implementation explicitly or implicitly disables SSL/TLS certificate verification when establishing HTTPS connections during Triton model import operations. This typically occurs when verify=False is passed to HTTP client libraries like requests or urllib3, or when custom SSL contexts are created without proper certificate chain validation.

Attack Vector

The attack vector is network-based, requiring the attacker to be positioned between the victim's SageMaker SDK client and the remote server hosting model artifacts. Common attack scenarios include:

The attacker performs ARP spoofing or DNS poisoning to redirect the victim's traffic through their controlled system. When the SageMaker SDK initiates a Triton model import over HTTPS, the attacker intercepts the connection and presents their own certificate. Due to the disabled certificate validation, the SDK accepts the malicious certificate without warning. The attacker can then inspect, modify, or replace the model artifacts in transit before forwarding them to the victim. This attack is particularly dangerous in cloud environments where network traffic may traverse multiple trust boundaries, or in scenarios where developers work from untrusted networks such as public Wi-Fi.

Detection Methods for CVE-2026-1778

Indicators of Compromise

• Unexpected SSL/TLS certificate warnings in network monitoring tools during SageMaker operations
• Network traffic analysis showing HTTPS connections that accept mismatched or self-signed certificates
• Audit logs indicating model imports from unexpected IP addresses or with unusual timing patterns
• Discrepancies between expected and actual model file hashes after Triton imports

Detection Strategies

• Monitor network traffic for TLS connections that complete successfully despite certificate validation failures
• Implement network-level certificate pinning or inspection at egress points for SageMaker traffic
• Deploy intrusion detection rules to alert on potential MITM attack patterns targeting ML infrastructure
• Review application logs for Triton model import operations and correlate with network traffic analysis

Monitoring Recommendations

• Enable detailed logging for all SageMaker SDK operations, particularly model imports
• Implement file integrity monitoring for downloaded model artifacts
• Configure network security groups to restrict outbound traffic to known, trusted model repositories
• Use SentinelOne Singularity Cloud Security to detect anomalous network behavior in ML workloads

How to Mitigate CVE-2026-1778

Immediate Actions Required

• Upgrade Amazon SageMaker Python SDK to v3.1.1 or later for the v3.x branch
• Upgrade Amazon SageMaker Python SDK to v2.256.0 or later for the v2.x branch
• Audit existing model artifacts imported using vulnerable SDK versions for potential tampering
• Review network security controls to minimize MITM attack surfaces

Patch Information

AWS has released patched versions addressing this vulnerability. Upgrade to Amazon SageMaker Python SDK v3.1.1 or v2.256.0 depending on your version branch. For additional details, refer to the AWS Security Bulletin 2026-004 and the GitHub Security Advisory GHSA-62rc-f4v9-h543.

Workarounds

• Restrict network access to trusted model repositories using firewall rules or security groups
• Implement network-level TLS inspection at egress points to validate certificates independently
• Use private VPC endpoints for SageMaker operations to reduce network exposure
• Manually verify integrity of imported models using cryptographic hashes before deployment

# Upgrade SageMaker SDK to patched version
pip install --upgrade sagemaker>=3.1.1

# For v2.x branch users
pip install --upgrade "sagemaker>=2.256.0,<3.0.0"

# Verify installed version
pip show sagemaker | grep Version