{"id":"CVE-2026-9291","kind":"vulnerability","aliases":["CVE-2026-9291","GHSA-g697-2xrc-gc46"],"related":[],"title":"amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()","description":"CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK\n\n### CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK\n\nBulletin ID: 2026-175-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/09/2026 14:15 PM PST\n\n Description:\n\nAmazon Braket SDK is an open source Python library that customers use to run quantum tasks and hybrid jobs on Amazon Braket and retrieve their results, and it uses the Amazon Braket Schemas library to parse task results.\n\nWe identified CVE-2026-124034, an issue in the local hybrid job input data download in the Amazon Braket SDK. A remote authenticated user with S3 write access to a hybrid job's input data location might be able to overwrite arbitrary files, with the privileges of the user running the job, by supplying crafted S3 object keys.\n\nWe identified CVE-2026-124035, an issue in the error mitigation schema validation in Amazon Braket Schemas, the library the Amazon Braket SDK uses to parse quantum task results. A remote authenticated user with S3 write access to the quantum task output location might be able to execute arbitrary code on any machine that retrieves the quantum task results by supplying a crafted task result document. Please note, this is a follow-on fix to the prior advisory CVE-2026-9291.\n\nImpacted versions:\n\n- CVE-2026-124034: amazon-braket-sdk >= 1.10.0 AND < 1.127.7\n- CVE-2026-124035: amazon-braket-schemas >= 1.17.0 AND < 1.32.2\n\nResolution:\n\n- CVE-2026-124034: This issue has been addressed in Amazon Braket SDK version 1.127.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n- CVE-2026-124035: This issue has been addressed in Amazon Braket Schemas version 1.32.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRestrict S3 write access to the Braket task-output and local-job input data locations (and the job's IAM role) to trusted principals.\n\nReferences:\n\n- CVE-2026-124034\n- CVE-2026-124035\n- GHSA-4hhf-mfx9-3877\n- GHSA-9r5x-g8jm-9mjj\n\nAcknowledgement:\n\nWe would like to thank Eva Crystal (0xiviel), XSource Security for collaborating on this issue through the coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"The Amazon Braket SDK for Python calls pickle.loads on data it reads, so it can run attacker-supplied code when it loads untrusted input. An attacker who can supply that input can get code execution on the machine running the SDK.","severity":"high","cvss":7.5,"epss":0.0038,"exploited":false,"exploited_at":null,"products":[{"name":"amazon-braket-sdk","fixed":["1.117.0"],"affected":">= 1.10.0, < 1.117.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["amazon-braket","amazon-braket-sdk","aws","cwe-502","lab-disclosure","package","python","quantum"],"not_affected_if":["no-braket-sdk-use","upgraded-to-1.117.0"],"how_to_check":"- Run `pip show amazon-braket-sdk` and compare the version with the affected range (>= `1.10.0`, < `1.117.0`).\n- Check whether your code or jobs read data from S3 locations that other principals can write to, since the bulletin points there for the related CVEs.","fix":"- amazon-braket-sdk (PyPI): upgrade to `1.117.0`.","status":"open","published_at":"2026-05-22T19:17:05+00:00","first_seen_at":"2026-11-09T23:46:36+00:00","triaged_at":"2026-11-09T23:51:24+00:00","updated_at":"2026-11-10T00:28:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T23:51:24Z","model":"claude-haiku-5-5","output":{"fix":"- amazon-braket-sdk (PyPI): upgrade to `1.117.0`.","reach":"unknown","title":"Amazon Braket SDK: unpickling task data can run code on the machine","impact":"high","summary":"The Amazon Braket SDK for Python calls pickle.loads on data it reads, so it can run attacker-supplied code when it loads untrusted input. An attacker who can supply that input can get code execution on the machine running the SDK.","audience":"developers","category":"package","nicknames":[],"who_cares":["amazon-braket-sdk","python","aws"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Arbitrary code runs on machines that load untrusted task data","analyst_note":"Confirm the attack path for CVE-2026-9291 in GHSA-g697-2xrc-gc46 (github.com/advisories/GHSA-g697-2xrc-gc46). The AWS bulletin's follow-on CVEs (CVE-2026-124034, CVE-2026-124035) list different fixed versions (SDK 1.127.7, Schemas 1.32.2) and must not be applied to this CVE.","how_to_check":"- Run `pip show amazon-braket-sdk` and compare the version with the affected range (>= `1.10.0`, < `1.117.0`).\n- Check whether your code or jobs read data from S3 locations that other principals can write to, since the bulletin points there for the related CVEs.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["upgraded-to-1.117.0","no-braket-sdk-use"],"who_is_affected":"Teams that run the Amazon Braket SDK for Python at a version from 1.10.0 up to but not including 1.117.0. The AWS bulletin for the follow-on CVEs ties the risk to users with S3 write access to task-output or hybrid-job input locations, so teams that tightly restrict those locations are less exposed; the sources do not confirm the same path for CVE-2026-9291 itself.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001722,"input_tokens":5604,"output_tokens":2324,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124034':86C,97C,168C,308C,329C,427C '-124035':89C,100C,226C,318C,364C,430C '-175':109C '-2026':12A,20A,85C,88C,96C,99C,167C,225C,302C,307C,317C,328C,363C,426C,429C '-502':35B '-9291':13A,21A,303C '0xiviel':449C '1.10.0':313C '1.127.7':315C,340C '1.17.0':323C '1.32.2':325C,375C '11/09/2026':120C '14':121C '15':122C '2026':108C '2xrc':17A '3877':435C '4hhf':433C '9mjj':440C '9r5x':438C 'abl':202C,267C 'access':191C,258C,401C 'acknowledg':441C 'address':334C,369C 'advisori':300C 'amazon':2A,23A,27B,30B,43B,92C,103C,126C,146C,156C,181C,236C,242C,310C,320C,336C,371C 'amazon-braket':26B 'amazon-braket-schema':319C 'amazon-braket-sdk':1A,22A,29B,309C 'arbitrari':205C,270C 'attack':59B,68B 'attacker-suppli':58B 'attent':117C 'authent':186C,253C 'aw':33B,110C,112C 'aws-security@amazon.com':465C 'braket':3A,24A,28B,31B,44B,93C,104C,127C,147C,157C,182C,237C,243C,311C,321C,337C,372C,404C 'bulletin':106C 'call':48B 'code':61B,76B,271C,354C,389C 'collabor':453C 'concern':472C 'content':113C 'coordin':459C 'craft':218C,284C 'crystal':448C 'custom':136C 'cve':11A,19A,84C,87C,95C,98C,166C,224C,301C,306C,316C,327C,362C,425C,428C 'cwe':34B 'data':51B,177C,198C,413C 'date':119C 'deriv':353C,388C 'descript':125C 'deseri':8A 'disclosur':38B,461C 'document':287C 'download':178C 'ecur':469C 'email':464C 'ensur':349C,384C 'error':231C 'eva':447C 'execut':77B,269C 'file':206C 'fix':296C,361C,396C 'follow':294C 'follow-on':293C 'fork':351C,386C 'g697':16A 'g8jm':439C 'gc46':18A 'get':75B 'ghsa':15A,432C,437C 'ghsa-4hhf-mfx9':431C 'ghsa-9r5x-g8jm-9mjj':436C 'ghsa-g697-2xrc-gc46':14A 'hybrid':143C,174C,194C 'iam':419C 'id':107C 'identifi':165C,223C 'impact':304C 'import':115C 'incorpor':358C,393C 'input':66B,73B,176C,197C,412C 'insecur':7A 'issu':90C,101C,170C,228C,331C,366C,456C,460C 'job':144C,175C,195C,215C,411C,417C 'key':221C 'lab':37B 'lab-disclosur':36B 'latest':346C,381C 'librari':134C,159C,240C 'like':444C 'load':64B 'local':173C,410C 'local-job':409C 'locat':199C,264C,414C 'machin':80B,274C 'mfx9':434C 'might':200C,265C 'mitig':232C 'new':360C,395C 'note':289C 'object':220C 'open':131C 'output':263C,407C 'overwrit':204C 'packag':39B 'pars':161C,247C 'patch':356C,391C 'pickle.loads':10A,49B 'pleas':288C,463C 'pm':123C 'princip':423C 'prior':299C 'privileg':209C 'process':462C 'pst':124C 'public':118C 'python':40B,47B,133C 'quantum':41B,140C,248C,261C,278C 'question':470C 'read':53B 'recommend':342C,377C 'refer':424C 'remot':185C,252C 'requir':116C 'resolut':326C 'restrict':398C 'result':151C,163C,250C,280C,286C 'retriev':149C,276C 'role':420C 'run':57B,81B,139C,213C 's3':189C,219C,256C,399C 'schema':158C,233C,238C,322C,373C 'scope':111C 'sdk':4A,25A,32B,45B,83B,94C,105C,128C,183C,244C,312C,338C 'secur':451C 'sourc':132C 'suppli':60B,71B,217C,282C 'task':141C,162C,249C,262C,279C,285C,406C 'task-output':405C 'thank':446C 'trust':422C 'type':114C 'untrust':65B 'upgrad':343C,378C 'use':137C,154C,245C 'user':187C,212C,254C 'valid':234C 'version':305C,339C,347C,374C,382C 'via':9A 'vulner':5A 'workaround':397C 'would':443C 'write':190C,257C,400C 'xsourc':450C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Amazon Braket SDK for Python at a version from 1.10.0 up to but not including 1.117.0. The AWS bulletin for the follow-on CVEs ties the risk to users with S3 write access to task-output or hybrid-job input locations, so teams that tightly restrict those locations are less exposed; the sources do not confirm the same path for CVE-2026-9291 itself.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["amazonbraketsdk"],"ptokens":["amazon","braket","sdk"],"labels":["amazonbraket","amazonbraketsdk","aws","cwe502","high","labdisclosure","package","pypi","python","quantum"],"campaign_type":null,"search_a":"'-2026':12A,20A '-9291':13A,21A '2xrc':17A 'amazon':2A,23A 'amazon-braket-sdk':1A,22A 'braket':3A,24A 'cve':11A,19A 'deseri':8A 'g697':16A 'gc46':18A 'ghsa':15A 'ghsa-g697-2xrc-gc46':14A 'insecur':7A 'pickle.loads':10A 'sdk':4A,25A 'via':9A 'vulner':5A","search_b":"'-502':35B 'amazon':27B,30B,43B 'amazon-braket':26B 'amazon-braket-sdk':29B 'attack':59B,68B 'attacker-suppli':58B 'aw':33B 'braket':28B,31B,44B 'call':48B 'code':61B,76B 'cwe':34B 'data':51B 'disclosur':38B 'execut':77B 'get':75B 'input':66B,73B 'lab':37B 'lab-disclosur':36B 'load':64B 'machin':80B 'packag':39B 'pickle.loads':49B 'python':40B,47B 'quantum':41B 'read':53B 'run':57B,81B 'sdk':32B,45B,83B 'suppli':60B,71B 'untrust':65B","search_c":"'-124034':86C,97C,168C,308C,329C,427C '-124035':89C,100C,226C,318C,364C,430C '-175':109C '-2026':85C,88C,96C,99C,167C,225C,302C,307C,317C,328C,363C,426C,429C '-9291':303C '0xiviel':449C '1.10.0':313C '1.127.7':315C,340C '1.17.0':323C '1.32.2':325C,375C '11/09/2026':120C '14':121C '15':122C '2026':108C '3877':435C '4hhf':433C '9mjj':440C '9r5x':438C 'abl':202C,267C 'access':191C,258C,401C 'acknowledg':441C 'address':334C,369C 'advisori':300C 'amazon':92C,103C,126C,146C,156C,181C,236C,242C,310C,320C,336C,371C 'amazon-braket-schema':319C 'amazon-braket-sdk':309C 'arbitrari':205C,270C 'attent':117C 'authent':186C,253C 'aw':110C,112C 'aws-security@amazon.com':465C 'braket':93C,104C,127C,147C,157C,182C,237C,243C,311C,321C,337C,372C,404C 'bulletin':106C 'code':271C,354C,389C 'collabor':453C 'concern':472C 'content':113C 'coordin':459C 'craft':218C,284C 'crystal':448C 'custom':136C 'cve':84C,87C,95C,98C,166C,224C,301C,306C,316C,327C,362C,425C,428C 'data':177C,198C,413C 'date':119C 'deriv':353C,388C 'descript':125C 'disclosur':461C 'document':287C 'download':178C 'ecur':469C 'email':464C 'ensur':349C,384C 'error':231C 'eva':447C 'execut':269C 'file':206C 'fix':296C,361C,396C 'follow':294C 'follow-on':293C 'fork':351C,386C 'g8jm':439C 'ghsa':432C,437C 'ghsa-4hhf-mfx9':431C 'ghsa-9r5x-g8jm-9mjj':436C 'hybrid':143C,174C,194C 'iam':419C 'id':107C 'identifi':165C,223C 'impact':304C 'import':115C 'incorpor':358C,393C 'input':176C,197C,412C 'issu':90C,101C,170C,228C,331C,366C,456C,460C 'job':144C,175C,195C,215C,411C,417C 'key':221C 'latest':346C,381C 'librari':134C,159C,240C 'like':444C 'local':173C,410C 'local-job':409C 'locat':199C,264C,414C 'machin':274C 'mfx9':434C 'might':200C,265C 'mitig':232C 'new':360C,395C 'note':289C 'object':220C 'open':131C 'output':263C,407C 'overwrit':204C 'pars':161C,247C 'patch':356C,391C 'pleas':288C,463C 'pm':123C 'princip':423C 'prior':299C 'privileg':209C 'process':462C 'pst':124C 'public':118C 'python':133C 'quantum':140C,248C,261C,278C 'question':470C 'recommend':342C,377C 'refer':424C 'remot':185C,252C 'requir':116C 'resolut':326C 'restrict':398C 'result':151C,163C,250C,280C,286C 'retriev':149C,276C 'role':420C 'run':139C,213C 's3':189C,219C,256C,399C 'schema':158C,233C,238C,322C,373C 'scope':111C 'sdk':94C,105C,128C,183C,244C,312C,338C 'secur':451C 'sourc':132C 'suppli':217C,282C 'task':141C,162C,249C,262C,279C,285C,406C 'task-output':405C 'thank':446C 'trust':422C 'type':114C 'upgrad':343C,378C 'use':137C,154C,245C 'user':187C,212C,254C 'valid':234C 'version':305C,339C,347C,374C,382C 'workaround':397C 'would':443C 'write':190C,257C,400C 'xsourc':450C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-05-22T18:16:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-175-aws/#CVE-2026-9291","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-175-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T23:46:36+00:00","fetched_at":"2026-11-09T23:46:36+00:00","note":"AWS: CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK"},{"source":"ghsa","external_id":"GHSA-g697-2xrc-gc46","url":"https://github.com/advisories/GHSA-g697-2xrc-gc46","severity":"high","published_at":"2026-06-25T18:34:18+00:00","modified_at":"2026-06-25T18:34:19+00:00","first_seen_at":"2026-11-09T23:48:20+00:00","fetched_at":"2026-11-09T23:48:20+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9291","severity":null,"published_at":"2026-05-22T19:17:05+00:00","modified_at":"2026-07-23T12:10:00+00:00","first_seen_at":"2026-11-10T00:28:47+00:00","fetched_at":"2026-11-10T00:28:47+00:00","note":null}],"documents":[{"id":110996,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-175-aws/","title":"AWS: CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK\n\n### CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK\n\nBulletin ID: 2026-175-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/09/2026 14:15 PM PST\n\n Description:\n\nAmazon Braket SDK is an open source Python library that customers use to run quantum tasks and hybrid jobs on Amazon Braket and retrieve their results, and it uses the Amazon Braket Schemas library to parse task results.\n\nWe identified CVE-2026-124034, an issue in the local hybrid job input data download in the Amazon Braket SDK. A remote authenticated user with S3 write access to a hybrid job's input data location might be able to overwrite arbitrary files, with the privileges of the user running the job, by supplying crafted S3 object keys.\n\nWe identified CVE-2026-124035, an issue in the error mitigation schema validation in Amazon Braket Schemas, the library the Amazon Braket SDK uses to parse quantum task results. A remote authenticated user with S3 write access to the quantum task output location might be able to execute arbitrary code on any machine that retrieves the quantum task results by supplying a crafted task result document. Please note, this is a follow-on fix to the prior advisory CVE-2026-9291.\n\nImpacted versions:\n\n- CVE-2026-124034: amazon-braket-sdk >= 1.10.0 AND < 1.127.7\n- CVE-2026-124035: amazon-braket-schemas >= 1.17.0 AND < 1.32.2\n\nResolution:\n\n- CVE-2026-124034: This issue has been addressed in Amazon Braket SDK version 1.127.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n- CVE-2026-124035: This issue has been addressed in Amazon Braket Schemas version 1.32.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nRestrict S3 write access to the Braket task-output and local-job input data locations (and the job's IAM role) to trusted principals.\n\nReferences:\n\n- CVE-2026-124034\n- CVE-2026-124035\n- GHSA-4hhf-mfx9-3877\n- GHSA-9r5x-g8jm-9mjj\n\nAcknowledgement:\n\nWe would like to thank Eva Crystal (0xiviel), XSource Security for collaborating on this issue through the coordinated issue disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":"2026-11-09T22:42:12+00:00","relation":"mentions","confidence":null,"note":null},{"id":111307,"url":"https://api.github.com/repos/amazon-braket/amazon-braket-sdk-python/security-advisories/GHSA-g697-2xrc-gc46","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":111308,"url":"https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-22T18:16:28+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":111309,"url":"https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.0038,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9291"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}