---
id: CVE-2026-8597
title: >-
  Missing integrity verification in Triton inference handler in Amazon SageMaker
  Python SDK
summary: >-
  Missing integrity verification in the Triton inference handler in Amazon
  SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a
  remote authenticated actor to achieve code execution in inference containers
  via replacem…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-354
vendor: AWS
product: Amazon SageMaker Python SDK
affected:
  - amazon_sagemaker_python_sdk >= 2.199.0 <= 2.257.1
  - amazon_sagemaker_python_sdk >= 3.0.0 <= 3.7.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-15T00:00:00+00:00'
published: '2026-05-14'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:07:38.889Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-8597'
references:
  - url: 'https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2'
  - url: 'https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-031-aws/'
  - url: >-
      https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-rq6v-x3j8-7qgf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8597'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-031-aws'
  - url: 'https://github.com/aws/sagemaker-python-sdk'
tags:
  - cve.org
  - osv
  - pip
epss: 0.00507
epssPercentile: 0.43079
aliases:
  - GHSA-rq6v-x3j8-7qgf
  - PYSEC-2026-3060
ecosystem: pip
patched:
  - sagemaker 2.257.2
  - sagemaker 3.8.0
ingestedAt: '2026-07-13T18:58:02.905Z'
---

## Overview

Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.



To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.

## Affected

- `amazon_sagemaker_python_sdk >= 2.199.0 <= 2.257.1`
- `amazon_sagemaker_python_sdk >= 3.0.0 <= 3.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-8597)

Affected packages:

- `sagemaker >= 2.199.0, < 2.257.2`
- `sagemaker >= 3.0.0, < 3.8.0`

Patched in:

- `sagemaker 2.257.2`
- `sagemaker 3.8.0`

Source: https://osv.dev/vulnerability/GHSA-rq6v-x3j8-7qgf