PyPI: sagemaker
CVE-2026-1778
Safety vulnerability ID: SFTY-20260202-03913
Safety legacy ID: pyup.io-85691
Affected versions of the sagemaker package are vulnerable to Improper Certificate Validation due to SSL certificate verification being globally disabled in the Triton Python backend. The sagemaker-serve/src/sagemaker/serve/model_server/triton/model.py module overwrites ssl._create_default_https_context with ssl._create_unverified_context, causing HTTPS downloads (including model and dependency retrieval) to skip certificate checks.
Overview
SageMaker Python SDK has Insecure TLS Configuration
Advisory
Affected versions of the sagemaker package are vulnerable to Improper Certificate Validation due to SSL certificate verification being globally disabled in the Triton Python backend. The sagemaker-serve/src/sagemaker/serve/model_server/triton/model.py module overwrites ssl._create_default_https_context with ssl._create_unverified_context, causing HTTPS downloads (including model and dependency retrieval) to skip certificate checks.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260202-03913/CVE-2026-1778
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1778
- https://github.com/advisories/GHSA-62rc-f4v9-h543
- https://github.com/aws/sagemaker-python-sdk/commit/5e7a3efa7bec0a161194ffa0cef346dda93bf2c6
- https://github.com/aws/sagemaker-python-sdk/commit/c8098958910f7db78d07037425debfd4d44a6964
- https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-62rc-f4v9-h543
- https://github.com/aws/sagemaker-python-sdk/commit/5e7a3efa7bec0a161194ffa0cef346dda93bf2c6
- https://github.com/aws/sagemaker-python-sdk/commit/c8098958910f7db78d07037425debfd4d44a6964
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-1778
- https://aws.amazon.com/security/security-bulletins/2026-004-AWS
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.1.1
- https://github.com/advisories/GHSA-62rc-f4v9-h543
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more