The vulnerability CVE-2026-8597 in Amazon SageMaker Python SDK arises from improper validation of integrity check values (CWE-354) in the Triton inference handler. Specifically, model artifacts stored in S3 can be replaced by a remote authenticated actor possessing write access with a crafted pickle payload. This payload is deserialized without verification, enabling arbitrary code execution inside inference containers. The issue affects SDK versions before v2.257.2 and v3.8.0. AWS has released patched versions to address this flaw and advises rebuilding Triton models created with the affected SDK versions.

Successful exploitation allows a remote authenticated user with S3 write permissions to execute arbitrary code within SageMaker inference containers by substituting model artifacts with malicious payloads. This compromises confidentiality, integrity, and availability of the inference environment. The CVSS score of 7.2 reflects high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild currently.

AWS recommends upgrading the Amazon SageMaker Python SDK to version v2.257.2 or v3.8.0 or later. Additionally, any Triton models previously created with ModelBuilder using affected SDK versions should be rebuilt using the updated SDK to ensure the vulnerability is fully mitigated. Since this is a cloud service, AWS manages the underlying infrastructure, but customers must update their SDK and models accordingly. Patch status is confirmed as available via vendor advisory: https://aws.amazon.com/security/security-bulletins/2026-031-aws/