CVE-2026-8596

Affected versions of the sagemaker package are vulnerable to Cleartext Storage of Sensitive Information due to the ModelBuilder/Serve component placing an HMAC signing key into a container environment variable in plaintext. When ModelBuilder builds and deploys models with the TorchServe, Multi-Model Server, TensorFlow Serving, SMD, or Triton model servers, the SDK generates an HMAC secret used for model artifact integrity verification and stores it as the SAGEMAKER_SERVE_SECRET_KEY environment variable on the SageMaker model container, which is then returned in plaintext by the DescribeModel, DescribeEndpointConfig, and DescribeModelPackage APIs. A remote authenticated actor with permission to call those describe APIs and S3 write access to the model artifact path can recover the key, forge valid integrity signatures for crafted artifacts, and execute arbitrary code in the inference container under the SageMaker execution role's IAM permissions.