CVE-2026-1778: Amazon SageMaker Python SDK Vulnerability

CVE-2026-1778 Overview

CVE-2026-1778 is a certificate validation vulnerability in the Amazon SageMaker Python SDK. Versions prior to v3.1.1 and v2.256.0 disable TLS certificate verification for HTTPS connections initiated when a Triton Python model is imported. The SDK accepts requests served with invalid or self-signed certificates, removing a core trust boundary for outbound HTTPS traffic. This weakness exposes model import workflows to machine-in-the-middle interception and tampering. The flaw is tracked under CWE-295: Improper Certificate Validation.

Critical Impact

An attacker positioned on the network path can substitute attacker-controlled content during Triton Python model imports, undermining model integrity in SageMaker pipelines.

Affected Products

• Amazon SageMaker Python SDK versions prior to v2.256.0 (2.x branch)
• Amazon SageMaker Python SDK versions prior to v3.1.1 (3.x branch)
• Workflows that import Triton Python models through the SDK

Discovery Timeline

• 2026-02-02 - CVE-2026-1778 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1778

Vulnerability Analysis

The Amazon SageMaker Python SDK exposes helper functionality for importing Triton Python models into SageMaker. During this import flow, the SDK issues HTTPS requests but disables TLS certificate verification on the underlying HTTP client. As a result, certificates presented by remote endpoints are not validated against trusted certificate authorities, expiration dates, or hostnames.

This defect maps to CWE-295, Improper Certificate Validation. The TLS session still negotiates encryption, but the authentication property of TLS is removed. Any server presenting any certificate, including self-signed certificates, is accepted as legitimate.

The vulnerability primarily affects integrity. An attacker who can intercept traffic between the SDK and the remote endpoint can substitute model artifacts, dependencies, or configuration data. The compromised content is then loaded into the SageMaker environment for execution.

Root Cause

The SDK code path for Triton Python model import explicitly disabled certificate verification on the HTTPS client used for outbound requests. This bypasses the default Python TLS trust chain enforcement and prevents detection of forged or expired certificates. The behavior was corrected in v2.256.0 and v3.1.1.

Attack Vector

Exploitation requires an attacker capable of intercepting or redirecting traffic during a Triton Python model import operation. Common scenarios include compromised DNS resolvers, rogue Wi-Fi or VPN gateways, BGP hijacks, or attacker-controlled HTTP proxies in CI/CD pipelines. Because the SDK accepts any certificate, the attacker does not need to obtain a valid certificate for the intended hostname. Refer to the GitHub Security Advisory GHSA-62rc-f4v9-h543 and the AWS Security Bulletin 2026-004 for vendor-confirmed technical details.

Detection Methods for CVE-2026-1778

Indicators of Compromise

• Outbound HTTPS connections from SageMaker training or inference hosts terminating on unexpected IP addresses or hostnames during model import
• TLS sessions to model import endpoints negotiated with self-signed or untrusted certificates
• Unexpected modifications to Triton model artifacts, config.pbtxt files, or Python backend scripts following an SDK import

Detection Strategies

• Inventory all environments running sagemaker-python-sdk and flag installations older than v2.256.0 on the 2.x branch or v3.1.1 on the 3.x branch
• Inspect outbound TLS traffic from SageMaker workloads using network sensors that record certificate fingerprints and issuer chains
• Compare hashes of imported Triton model artifacts against known-good baselines from the source repository

Monitoring Recommendations

• Forward SageMaker notebook, training job, and endpoint logs to a centralized data lake for correlation with network telemetry
• Alert on SDK invocations that originate from hosts with non-standard egress paths or proxies
• Monitor CI/CD pipelines for unauthorized changes to SDK pinning in requirements.txt or pyproject.toml

How to Mitigate CVE-2026-1778

Immediate Actions Required

• Upgrade the Amazon SageMaker Python SDK to v2.256.0 for the 2.x branch or v3.1.1 for the 3.x branch
• Audit recent Triton Python model imports and revalidate artifact integrity against trusted sources
• Restrict outbound network paths from SageMaker workloads to known, authenticated endpoints only

Patch Information

Amazon Web Services released fixed versions of the SDK that restore TLS certificate verification for HTTPS requests in the Triton Python model import path. See GitHub Release v2.256.0, GitHub Release v3.1.1, and AWS Security Bulletin 2026-004 for release notes and remediation guidance.

Workarounds

• Avoid using the affected Triton Python model import code path until the SDK is upgraded
• Route Triton model imports through controlled, VPC-internal endpoints that terminate TLS on trusted infrastructure
• Pin SDK versions in build manifests to enforce the patched release across all training and deployment environments

# Upgrade to a patched release of the SageMaker Python SDK
pip install --upgrade "sagemaker>=2.256.0,<3.0.0"
# Or, for the 3.x branch
pip install --upgrade "sagemaker>=3.1.1"

# Verify the installed version
python -c "import sagemaker; print(sagemaker.__version__)"