Aws Sagemaker Python SDK vulnerabilities

3 CVEs affecting Aws Sagemaker Python SDK, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110248, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-110248, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to…
CVE-2026-1777, published 2026-02-02. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with…
CVE-2026-1778, published 2026-02-02. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for…