CVE-2026-1777
Last modified
CVE-2026-1777 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-1777?
How severe is CVE-2026-1777?
How do I fix CVE-2026-1777?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-17764Inappropriate implementation in FedCM in Google Chrome prior…6.5
- CVE-2026-17765Inappropriate implementation in WebProtect in Google Chrome …4.3
- CVE-2026-17766Insufficient validation of untrusted input in Clipboard in G…3.3
- CVE-2026-17767Insufficient validation of untrusted input in WebView in Goo…4.3
- CVE-2026-17768Insufficient validation of untrusted input in WebSockets in …9.6
- CVE-2026-17769Insufficient validation of untrusted input in Cast in Google…4.3
- CVE-2026-17770Out of bounds read in Media in Google Chrome on Mac prior to…5.8
- CVE-2026-17771Uninitialized Use in Skia in Google Chrome prior to 151.0.79…4.3
- CVE-2026-17772Out of bounds read in WebGL in Google Chrome prior to 151.0.…4.3
- CVE-2026-17773Insufficient validation of untrusted input in Cast in Google…4.3
- CVE-2026-17774Insufficient validation of untrusted input in Variations in …7.5
- CVE-2026-17775Inappropriate implementation in PresentationAPI in Google Ch…4.3
Are you affected by CVE-2026-1777?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST