Description

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T19:17:29.483Z",
  "pubdate": "2026-09-01T19:17:29.483Z",
  "executiveSummary": "A critical vulnerability exists in the Amazon SageMaker Python SDK involving the cleartext storage of sensitive information within pipeline components. Specifically, the @step and @remote decorators inadvertently expose the HMAC signing key in API responses generated by the SageMaker DescribePipeline function.\nThis vulnerability allows an authenticated remote user within the same AWS account to intercept this signing key. By obtaining the key, an attacker can forge valid integrity signatures for malicious function payloads. This compromise facilitates unauthorized code execution within the context of other users' pipeline executions, leading to potential lateral movement, data exfiltration, or unauthorized control over pipeline workflows.\nThe vulnerability affects versions of the Amazon SageMaker Python SDK prior to v3.11.0 and v2.256.0. The risk is significant as it undermines the integrity and isolation of pipeline executions, allowing an authenticated user to achieve remote code execution in shared execution environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of sensitive configuration data within the @step and @remote decorators of the Amazon SageMaker Python SDK. These components were designed to facilitate pipeline orchestration; however, they erroneously persist the HMAC signing key in cleartext within the metadata returned by the SageMaker DescribePipeline API.\nThe attack flow initiates when an authenticated user—who possesses read access to pipeline descriptions—queries the DescribePipeline API for a target pipeline execution. Because the SDK improperly includes the HMAC signing key in the API response payload, the attacker can extract this secret key directly from the serialized output.\nOnce the HMAC signing key is exfiltrated, the attacker gains the ability to calculate valid integrity signatures for arbitrary, specially crafted function payloads. In the SageMaker pipeline architecture, these signatures are intended to verify the provenance and integrity of the code executed by the pipeline. By applying a forged signature to a malicious payload, the attacker effectively bypasses security controls that ensure only authorized code is processed by the pipeline execution engine.\nThe exploitation allows the attacker to achieve code execution in the context of another user's pipeline execution. Since the code runs within the same AWS account, the attacker can leverage the underlying service roles and permissions associated with the pipeline environment. This may grant the attacker access to sensitive data, internal service interactions, or cloud infrastructure resources beyond the scope of their original privileges.\nThe vulnerable component is identified as the decorator logic within the Amazon SageMaker Python SDK. The scope of impact is limited to the same AWS account but does not require additional administrative privileges beyond standard authenticated access to the SageMaker API. The flaw is addressed in SDK versions v3.11.0 and v2.256.0 and later, which enforce correct sanitization and obfuscation of sensitive pipeline artifacts."
}