CVE-2026-83551

HighCVSS 7.2/10Last modified Sep 3, 2026

Description

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Sep 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-835555.3The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a suCVE-2026-835575.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly CVE-2026-83565.4LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement reCVE-2026-835605.3The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when theCVE-2026-835617.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via ElemCVE-2026-835626.5Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-835647.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835655.5Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.CVE-2026-835667.0Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-835677.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835687.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-835697.8Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.