CVSS 4.0
8.2 highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-1778
High (8.2). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in sagemaker 2.256.0, 3.1.1.
Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed.
Severity
CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-62rc-f4v9-h543 | PyPI | sagemaker | >=3.0 <3.1.1 | 3.1.1 |
| GHSA-62rc-f4v9-h543 | PyPI | sagemaker | <2.256.0 | 2.256.0 |
| PYSEC-2026-1886 | PyPI | sagemaker | <2.256.0 >=3.0 <3.1.1 | 2.256.0, 3.1.1 |