Executive brief
The SageMaker Python SDK's pipeline decorator components use HMAC keys to verify the integrity of code payloads stored in AWS S3. A vulnerability exposes these signing keys in cleartext within pipeline definitions, allowing anyone with describe-pipeline permissions in the AWS account to retrieve them, forge valid payloads, and execute arbitrary code in another user's pipeline context. This breaks the security boundary for teams sharing an AWS account and could lead to unauthorized data access or malicious code execution.
Technical details
The SageMaker Python SDK uses HMAC keys to cryptographically sign serialized function payloads that are stored in S3 as part of pipeline definitions. The vulnerability is a cleartext storage issue: these secret keys are embedded unencrypted in the pipeline definition document and exposed via the DescribePipeline API call. An attacker with an IAM role that has DescribePipeline permissions can call the API, retrieve the HMAC key from the pipeline metadata, and then craft valid cloud-pickled payloads with correct HMACs. The attacker can then overwrite S3 objects to inject malicious code that executes during another user's pipeline execution context. The precondition is IAM permissions to invoke DescribePipeline within the same AWS account; the attack is unauthenticated once those permissions are obtained. Patches are available in SageMaker Python SDK v3.11.0+ and v2.256.0+.
Affected products
- Amazon SageMaker Python SDK v3 < 3.11.0, v2 < 2.256.0
Timeline
- 2026-09-09: disclosed
- 2026-09-01: advisory: AWS Security Bulletin 2026-093-AWS published