CVE-2026-8597: Amazon SageMaker Python SDK Triton Inference Handler Integrity Verification Flaw
Summary
CVE-2026-8597: Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler. Affects sagemaker across 2 version ranges.
>= 2.199.0, < 2.257.2
>= 3.0.0, < 3.8.0
Fixed in 2.257.2 or 3.8.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Amazon SageMaker Python SDK is an open-source library designed for training and deploying machine learning models on Amazon SageMaker. It provides a range of functionalities, including model training, deployment, and inference handling. The SDK is widely used for its ease of integration with AWS services and its support for various machine learning frameworks. However, a significant vulnerability has been identified in the Triton inference handler, which could lead to severe security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the Triton inference handler's failure to perform integrity verification when deserializing model artifacts. This oversight allows an attacker with S3 write access to replace model files with malicious payloads. When the Triton handler processes these files, it can execute arbitrary code, potentially compromising the SageMaker execution role's IAM permissions. This vulnerability affects versions >= v2.199.0 and <= v2.257.1, as well as >= v3.0.0 and <= v3.7.1.
How To Fix
Latest published version: 3.27.0 as of 22 Oct 2026
pip install --upgrade "sagemaker==3.27.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.199.0, < 2.257.22.257.2pip install --upgrade "sagemaker==2.257.2" -
>= 3.0.0, < 3.8.03.8.0pip install --upgrade "sagemaker==3.8.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, users should restrict S3 write access to model artifact paths to only trusted principals. Additionally, monitoring for unintended modifications to files in model artifact S3 locations is advised.
Conclusion
The CVE-2026-8597 vulnerability in the Amazon SageMaker Python SDK poses a significant risk due to the lack of integrity verification in the Triton inference handler. It is crucial for users to upgrade to the patched versions to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for sagemaker →
FAQ
CVE-2026-8597 is a vulnerability in the Amazon SageMaker Python SDK that allows for arbitrary code execution due to a lack of integrity verification in the Triton inference handler.
The affected versions are >= v2.199.0 and <= v2.257.1, as well as >= v3.0.0 and <= v3.7.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary code with the SageMaker execution role's IAM permissions, leading to unauthorized access and data breaches.
If upgrading is not possible, restrict S3 write access to model artifact paths to trusted principals and monitor for any unauthorized changes.
Related vulnerabilities
Recent vulnerabilities recorded for sagemaker.
