How Cleartext HMAC Keys in SageMaker SDK Enable Code Execution

The malicious code behavior enabled by CVE-2026-83551 involves an attacker extracting a secret key stored in cleartext within Amazon SageMaker pipeline definitions. According to the AWS Security Bulletin published on September 1, 2026, this flaw allows actors with specific account roles to invoke the DescribePipeline API and retrieve the HMAC secret key used to protect serialized function payloads.

Once the key is extracted, the attacker can create cloud-pickled payloads with valid HMAC signatures and overwrite objects in Amazon S3. This action achieves code execution in another user's pipeline execution context within the same AWS account, bypassing the integrity protections intended by the SDK's decorator pipeline components.

How does the vulnerability work technically?

The SageMaker Python SDK uses HMAC keys to protect the integrity of serialized function payloads stored in S3 when using the @step and @remote decorator pipeline components. The vulnerability exists because the HMAC secret key is stored in cleartext within the pipeline definitions themselves. This makes the key accessible to anyone who can call the DescribePipeline API, rather than keeping it secure or ephemeral.

An actor with a role in the AWS account that has permissions to invoke DescribePipeline can extract this key. With the key in hand, they can generate valid HMACs for malicious payloads. By overwriting S3 objects with these forged payloads, the attacker forces the pipeline to execute their code in the context of the legitimate user's pipeline execution.

Which versions are affected and fixed?

The issue impacts HMAC Configuration in SageMaker Python SDK v3 versions earlier than 3.11.0 and v2 versions earlier than 2.256.0. AWS addressed the issue in version 3.11.0 for v3 and 2.256.0 for v2. The v3 fix replaces symmetric HMAC signing with asymmetric ECDSA signing, ensuring that only the private key on the client can generate valid signatures.

The v2 fix removes the stored key entirely. For users of the @step decorator, upgrading the SDK and updating existing pipeline definitions is required to replace the stored symmetric key with an asymmetric public key. For @remote decorator users, upgrading the SDK is sufficient because each invocation creates a fresh job with no persisted key material.

What mitigation steps are available now?

Customers who cannot immediately upgrade their SDK versions should restrict sagemaker:DescribePipeline IAM permissions to only trusted users within the account. This limits the number of actors who can extract the cleartext key. Additionally, teams should configure a dedicated per-user s3_root_uri for @remote and @step decorator workloads to isolate serialized payloads from one another.

AWS recommends upgrading to the latest version and updating existing pipeline definitions created via the @step decorator by calling pipeline.upsert(). This ensures that previously registered pipelines are no longer exposed to the cleartext key vulnerability. The vendor thanked researcher @kimchikingdom for collaborating on the coordinated disclosure of this issue.

What analysts watch for

Teams usually monitor for unusual DescribePipeline API calls from unexpected roles or IP addresses, as this indicates key extraction attempts. Analysts check S3 buckets for unauthorized object overwrites, particularly cloud-pickled payloads with valid signatures that differ from known baselines. They examine pipeline execution logs for code running in contexts that do not match the original user's permissions. Teams also review IAM policies to ensure that only trusted users have access to sensitive pipeline metadata and that per-user storage isolation is enforced for decorator workloads.

What to do and how to stay safe: AWS

• Upgrade SageMaker Python SDK to v3.11.0 or v2.256.0 or later to apply the vendor's fix.
• Restrict IAM permissions for sagemaker:DescribePipeline to only trusted users if immediate upgrade is not possible.
• Configure dedicated per-user s3_root_uri for @remote and @step decorator workloads to isolate serialized payloads.
• Update existing pipeline definitions created via @step decorator by calling pipeline.upsert() after upgrading the SDK.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-83551?

It is a cleartext storage vulnerability in the Amazon SageMaker Python SDK that exposes HMAC signing keys via the DescribePipeline API.

Which SDK versions are vulnerable?

SageMaker Python SDK v3 versions before 3.11.0 and v2 versions before 2.256.0 are affected by this issue.

Does upgrading fix existing pipelines automatically?

No, users of the @step decorator must update existing pipeline definitions by calling pipeline.upsert() after upgrading the SDK.