The vulnerability CVE-2026-8596 affects Amazon SageMaker Python SDK versions prior to v2.257.2 and v3.8.0. It is caused by cleartext storage of sensitive information (HMAC signing keys) in the ModelBuilder/Serve component. An authenticated remote attacker with permissions to invoke SageMaker describe APIs and write to the S3 model artifact path can extract these keys from API responses. With the extracted keys, the attacker can forge integrity signatures for malicious model artifacts, leading to code execution in inference containers. The issue is mitigated by upgrading to the patched SDK versions and rebuilding models with the updated SDK. AWS, as a cloud service provider, manages remediation for the service environment.

Successful exploitation allows a remote authenticated user with specific permissions to extract HMAC signing keys, forge integrity signatures, and execute arbitrary code within inference containers. This compromises confidentiality, integrity, and availability of the affected SageMaker inference workloads. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability.

A patch is available by upgrading the Amazon SageMaker Python SDK to version 2.257.2 or later, or version 3.8.0 or later. Additionally, rebuild any models previously created with the vulnerable SDK versions using the updated SDK. Since this is a cloud-hosted service, AWS manages remediation for the underlying infrastructure. Users should follow the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-031-aws/ for detailed guidance.