# CVE-2026-1777: Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

> CVE-2026-1777: Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk. CVSS 7.2 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-1777
Last updated: 2026-06-17T10:16:30Z

- Published: 2026-02-02 20:10 UTC · Updated: 2026-06-17 10:16 UTC · Assigner: AMZN
- CVSS: 7.2 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.52%, 44th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-319

## Description

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.

## Affected vendors and products

- AWS: SageMaker Python SDK

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-1777)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-1777)
- [https://aws.amazon.com/security/security-bulletins/2026-004-AWS/](https://aws.amazon.com/security/security-bulletins/2026-004-AWS/)
- [https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0](https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0)
- [https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.2.0](https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.2.0)
- [https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rjrp-m2jw-pv9c](https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rjrp-m2jw-pv9c)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-1777 · Markdown: https://rewindex.com/cve/CVE-2026-1777.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-1777 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:04:05.335Z