CVE-2026-83551 Overview
CVE-2026-83551 is a cleartext storage of sensitive information vulnerability [CWE-312] affecting the Amazon SageMaker Python SDK. The flaw resides in the @step and @remote decorator pipeline component in versions prior to v3.11.0 and v2.256.0. An authenticated remote user can extract the HMAC signing key from DescribePipeline API responses. With that key, the attacker forges valid integrity signatures for crafted function payloads and executes code inside another user's pipeline execution context within the same AWS account.
Critical Impact
Cross-tenant code execution within a shared AWS account, allowing an authenticated user to hijack another user's SageMaker pipeline execution and pivot with that pipeline's IAM permissions.
Affected Products
- Amazon SageMaker Python SDK versions before v2.256.0 (2.x branch)
- Amazon SageMaker Python SDK versions before v3.11.0 (3.x branch)
- SageMaker pipelines using the @step and @remote decorators
Discovery Timeline
- 2026-09-01 - CVE-2026-83551 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-83551
Vulnerability Analysis
The Amazon SageMaker Python SDK provides the @step and @remote decorators to serialize Python functions and dispatch them as remote pipeline steps. To protect payload integrity between the client and the SageMaker execution environment, the SDK signs serialized function payloads using an HMAC key. The SDK stores this HMAC signing key in cleartext where it is returned in responses from the SageMaker DescribePipeline API. Any principal with DescribePipeline permission on a pipeline can retrieve the key. Because the same signing key gates whether a payload is accepted as authentic, an attacker who reads it can generate signatures indistinguishable from those produced by the legitimate pipeline author. This breaks the trust boundary between users sharing an AWS account.
Root Cause
The root cause is insecure handling of a secret cryptographic material. The HMAC signing key is embedded in pipeline metadata rather than being held in a secret store or scoped to a caller identity. Its exposure through a routine describe API converts an integrity mechanism into a shared secret readable by any authenticated caller with pipeline read access.
Attack Vector
An authenticated user within the AWS account calls DescribePipeline on a target pipeline created by another user. The response reveals the HMAC signing key associated with the pipeline's @step or @remote decorator payloads. The attacker crafts a malicious serialized function, computes a valid HMAC over it using the stolen key, and submits the payload. When the target pipeline next executes, it accepts the forged payload as authentic and runs the attacker-supplied code under the pipeline's IAM role.
No verified public exploit code is available for CVE-2026-83551. See the GitHub Security Advisory GHSA-7xmc-crrw-fv5r for authoritative technical details.
Detection Methods for CVE-2026-83551
Indicators of Compromise
- Unexpected DescribePipeline API calls from IAM principals that do not normally interact with a given pipeline, visible in AWS CloudTrail.
- Pipeline executions launched with function payloads or container arguments that do not match the source-controlled pipeline definition.
- New or modified IAM activity performed under a SageMaker pipeline execution role that deviates from its baseline behavior.
Detection Strategies
- Correlate CloudTrail DescribePipeline events with subsequent StartPipelineExecution or step invocations from different principals within a short window.
- Baseline the set of principals authorized to describe each pipeline and alert on out-of-baseline reads.
- Inspect executed step payload hashes against a known-good manifest maintained by the pipeline owner.
Monitoring Recommendations
- Ingest CloudTrail and SageMaker service logs into a centralized analytics platform and retain them long enough to reconstruct pipeline authorship chains.
- Enable AWS GuardDuty and configure alerts for anomalous SageMaker API usage patterns.
- Monitor IAM role session activity for SageMaker pipeline execution roles for unexpected data access or outbound calls.
How to Mitigate CVE-2026-83551
Immediate Actions Required
- Upgrade the Amazon SageMaker Python SDK to v2.256.0 on the 2.x branch or v3.11.0 on the 3.x branch immediately.
- Rotate any SageMaker pipelines created with vulnerable SDK versions by recreating them after the upgrade so a new signing key is generated.
- Audit CloudTrail for historical DescribePipeline calls by principals outside the pipeline owner's team and investigate any anomalies.
- Review IAM policies to restrict sagemaker:DescribePipeline to only the principals that require it.
Patch Information
Amazon Web Services shipped fixes in GitHub Release v2.256.0 of the SageMaker Python SDK and GitHub Release v3.11.0. Full context is available in the AWS Security Bulletin 2026-093 and the GitHub Security Advisory GHSA-7xmc-crrw-fv5r.
Workarounds
- Restrict use of the @step and @remote decorators until all pipeline authors have upgraded to a fixed SDK version.
- Apply least-privilege IAM policies that scope sagemaker:DescribePipeline to specific pipeline ARNs and specific principals.
- Segregate sensitive machine learning workloads into dedicated AWS accounts to eliminate cross-user exposure within a shared account.
# Configuration example: upgrade the SageMaker Python SDK to a patched version
pip install --upgrade "sagemaker>=2.256.0,<3.0.0"
# or, for the 3.x branch
pip install --upgrade "sagemaker>=3.11.0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.