Cleartext storage of the HMAC signing key in the ModelBuilder/Serve component allows a remote authenticated actor to pull the key from SageMaker API responses. The actor can then forge valid integrity signatures for specially crafted model artifacts, achieving code execution within inference containers. The weakness is a classic example of insecure cryptographic storage, classified as CWE‑312.

Amazon SageMaker Python SDK versions before v2.257.2 in the v2 series and before v3.8.0 in the v3 series are affected. The vulnerability applies to any user of the SDK who relies on ModelBuilder and has the ability to describe SageMaker resources and write to the S3 model artifact location.

The CVSS score of 8.5 indicates high severity, though no public exploit is currently documented and the EPSS score is not available. The vulnerability requires an authenticated user with sufficient SageMaker describe API permissions and S3 write access to the model artifact path. An attacker could extract the cleartext key, create a maliciously signed model artifact, upload it to the target S3 bucket, and trigger code execution when the artifact is loaded into a SageMaker inference container.