Detections
Analytics
SCA: security update for sagemaker (GHSA-7hh5-prp2-mfh5)
high Tenable Cloud Security Plugin ID 442260
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python
SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC
signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model
artifacts, achieving code execution in inference containers. This issue requires a remote authenticated
actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path. To
remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild
any models previously created with ModelBuilder using the updated SDK. (CVE-2026-8596)
Solution
Update the sagemaker library and its related packages to version 2.257.2 or later.See Also
Plugin Details
Severity: High
ID: 442260
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 5/21/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.96
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.3
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C
CVSS Score Source: CVE-2026-8596
CVSS v3
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.5
Threat Score: 5.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/21/2026
Vulnerability Publication Date: 5/14/2026
Reference Information
CVE: CVE-2026-8596
cwe: CWE-312