AWS patches SageMaker model-artifact integrity flaws

Per the AWS security bulletin (Bulletin ID 2026-031-AWS, posted 05/14/2026), two vulnerabilities, CVE-2026-8596 and CVE-2026-8597, were found in the Amazon SageMaker Python SDK ModelBuilder/Serve component. AWS reports that affected SDK versions include >= v2.199.0 and <= v2.257.1 and >= v3.0.0 and <= v3.7.1. AWS states the flaws allowed an authenticated actor with permissions to call Describe APIs and S3 write access to extract an HMAC key or replace model artifacts and cause remote code execution in inference containers.

Per the bulletin, the first issue stored an HMAC signing key in cleartext as the container environment variable SAGEMAKER_SERVE_SECRET_KEY, and the key could be returned via SageMaker Describe APIs (DescribeModel, DescribeEndpointConfig, DescribeModelPackage). The second issue involves the Triton inference handler deserializing model artifacts without integrity verification; AWS reports a specially crafted pickle payload could be executed if written to the model artifact path. AWS lists fixes in v2.257.2 and v3.8.0 and recommends upgrading and rebuilding models created with affected SDK versions. As an interim mitigation, AWS documents recreating models without the SAGEMAKER_SERVE_SECRET_KEY environment variable.

vulnerabilities that combine API visibility with S3 write access create a high-impact attack surface for ML deployments, because they let an attacker introduce or authenticate malicious artifacts that execute inside inference containers. Industry-pattern observations: similar incidents frequently hinge on key exposure or missing verification in third-party handlers, not on core model code, and therefore can persist across deployments until artifacts are rebuilt.

Observers should track whether any managed inference integrations or downstream tooling also relied on the affected integrity mechanism, and whether toolchains automatically rebuild models during SDK upgrades. Patch adoption metrics and notices from major customers will indicate the practical exposure window.