Executive brief
The Amazon SageMaker Python SDK is a library used to build, train, and deploy machine learning models. A security flaw in its Triton inference handler allows an attacker with specific storage permissions to execute malicious code within the model's environment. This could lead to a full compromise of the SageMaker execution role, potentially exposing sensitive data or allowing unauthorized access to other AWS resources.
Technical details
A vulnerability exists in the Amazon SageMaker Python SDK's Triton inference handler due to the deserialization of untrusted model artifacts without integrity verification (CWE-354). When using ModelBuilder with a Triton inference server, the handler fails to validate model files before processing them. An attacker with S3 write access to the model artifact path can replace legitimate files with a malicious pickle payload. This payload is automatically deserialized during container lifecycle events, resulting in arbitrary code execution with the permissions of the SageMaker execution IAM role. The issue is fixed in versions 2.257.2 and 3.8.0.
Affected products
- Amazon SageMaker Python SDK >= 2.199.0, <= 2.257.1; >= 3.0.0, <= 3.7.1
Timeline
- 2026-05-14: disclosed
- 2026-05-14: patched: Versions 2.257.2 and 3.8.0 released
- 2026-05-21: advisory
References
- https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rq6v-x3j8-7qgf
- https://aws.amazon.com/security/security-bulletins/2026-031-aws
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0
- https://api.github.com/repos/aws/sagemaker-python-sdk/security-advisories/GHSA-rq6v-x3j8-7qgf