Vulnerability · Published Feb 2, 2026 · Assigned by AMZN
CVE-2026-1778TLS disabled by default in select aws/sagemaker-python-sdk configurations
Medium 5.9
In plain English
A medium-severity improper certificate validation in SageMaker Python SDK from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | sagemaker | 3.1.1 | GHSA-62rc-f4v9-h543 |
| PyPI | sagemaker | 2.256.0 | GHSA-62rc-f4v9-h543 |
| PyPI | sagemaker | 2.256.0, 3.1.1 | PYSEC-2026-1886 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | SageMaker Python SDK | see references |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://aws.amazon.com/security/security-bulletins/2026-004-AWS/ vendor-advisory
- https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-62rc-f4v9-h543 third-party-advisory
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.1.1 patch
- https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0 patch