CVE-2026-8597

Affected versions of the sagemaker package are vulnerable to Insecure Deserialisation due to the ModelBuilder Triton inference handler deserialising model artifacts without performing integrity verification. The Triton handler loads artifacts retrieved from the configured S3 model artifact path through Python pickle without first validating their integrity, allowing tampered artifacts to be unpickled during container lifecycle events. A remote authenticated actor with S3 write access to the model artifact path can replace a model file with a crafted pickle payload that executes on the next container start, achieving Remote Code Execution under the SageMaker execution role's IAM permissions.