Vulnerability-Lookup

CVE-2026-9291 (GCVE-0-2026-9291)

Vulnerability from cvelistv5 – Published: 2026-05-22 18:12 – Updated: 2026-05-22 19:03

Title

Insecure Deserialization in Amazon Braket SDK Job Results Processing

Summary

Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results. We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-22 19:03 UTC

CWE

CWE-502 - Deserialization of untrusted data

Assigner

AMZN mitre root

References

3 references

URL	Tags
https://github.com/amazon-braket/amazon-braket-sd…	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/amazon-braket/amazon-braket-sd…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
AWS	Amazon Braket Python SDK	Affected: 1.10.0 , < 1.117.0 (custom) cpe:2.3:a:aws:amazon_braket_python_sdk::::::::

Date Public

2026-05-22 18:11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T19:03:31.240372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T19:03:41.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Amazon Braket Python SDK",
          "vendor": "AWS",
          "versions": [
            {
              "lessThan": "1.117.0",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:amazon_braket_python_sdk:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.117.0",
                  "versionStartIncluding": "1.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "datePublic": "2026-05-22T18:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsecure deserialization in the job results processing component in Amazon Braket SDK before\u0026nbsp;1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\u003c/p\u003e\u003cp\u003eWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.\u003c/p\u003e"
            }
          ],
          "value": "Insecure deserialization in the job results processing component in Amazon Braket SDK before\u00a01.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\n\n\n\nWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of untrusted data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T18:17:01.883Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-036-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insecure Deserialization in Amazon Braket SDK Job Results Processing",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-9291",
    "datePublished": "2026-05-22T18:12:24.452Z",
    "dateReserved": "2026-05-22T17:08:22.626Z",
    "dateUpdated": "2026-05-22T19:03:41.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-9291",
      "date": "2026-09-17",
      "epss": "0.0038",
      "percentile": "0.31773"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-9291\",\"sourceIdentifier\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"published\":\"2026-05-22T19:17:05.340\",\"lastModified\":\"2026-07-23T12:10:00.110\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insecure deserialization in the job results processing component in Amazon Braket SDK before\u00a01.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\\n\\n\\n\\nWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.\"},{\"lang\":\"es\",\"value\":\"La deserializaci\u00f3n insegura en el componente de procesamiento de resultados de trabajos en el SDK de Amazon Braket anterior a 1.117.0 podr\u00eda permitir a un usuario remoto autenticado con acceso de escritura a S3 al bucket de salida del trabajo lograr la ejecuci\u00f3n de c\u00f3digo arbitrario en cualquier m\u00e1quina que procese los resultados del trabajo.\\n\\nRecomendamos actualizar a la versi\u00f3n 1.117.0 o posterior de amazon-braket-sdk.\"}],\"affected\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"affectedData\":[{\"vendor\":\"AWS\",\"product\":\"Amazon Braket Python SDK\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.10.0\",\"lessThan\":\"1.117.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-22T19:03:31.240372Z\",\"id\":\"CVE-2026-9291\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://aws.amazon.com/security/security-bulletins/2026-036-aws/\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\"},{\"url\":\"https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\"},{\"url\":\"https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:18:51+00:00",
      "cve": "CVE-2026-9291",
      "id": "CVE-2026-9291",
      "initial_release_date": "2026-05-22T18:11:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Insecure Deserialization in Amazon Braket SDK Job Results Processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9291.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-9291\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-22T19:03:31.240372Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-22T19:03:36.812Z\"}}], \"cna\": {\"title\": \"Insecure Deserialization in Amazon Braket SDK Job Results Processing\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-586\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-586 Object Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"AWS\", \"product\": \"Amazon Braket Python SDK\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.10.0\", \"lessThan\": \"1.117.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-05-22T18:11:00.000Z\", \"references\": [{\"url\": \"https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0\", \"tags\": [\"patch\"]}, {\"url\": \"https://aws.amazon.com/security/security-bulletins/2026-036-aws/\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insecure deserialization in the job results processing component in Amazon Braket SDK before\\u00a01.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\\n\\n\\n\\nWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eInsecure deserialization in the job results processing component in Amazon Braket SDK before\u0026nbsp;1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\u003c/p\u003e\u003cp\u003eWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of untrusted data\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:aws:amazon_braket_python_sdk:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.117.0\", \"versionStartIncluding\": \"1.10.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"ff89ba41-3aa1-4d27-914a-91399e9639e5\", \"shortName\": \"AMZN\", \"dateUpdated\": \"2026-05-22T18:17:01.883Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-9291\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-22T19:03:41.903Z\", \"dateReserved\": \"2026-05-22T17:08:22.626Z\", \"assignerOrgId\": \"ff89ba41-3aa1-4d27-914a-91399e9639e5\", \"datePublished\": \"2026-05-22T18:12:24.452Z\", \"assignerShortName\": \"AMZN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-9291

Vulnerability from fkie_nvd - Published: 2026-05-22 19:17 - Updated: 2026-07-23 12:10

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://aws.amazon.com/security/security-bulletins/2026-036-aws/
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Amazon Braket Python SDK",
          "vendor": "AWS",
          "versions": [
            {
              "lessThan": "1.117.0",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insecure deserialization in the job results processing component in Amazon Braket SDK before\u00a01.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.\n\n\n\nWe recommend you upgrade to amazon-braket-sdk version 1.117.0 or later."
    },
    {
      "lang": "es",
      "value": "La deserializaci\u00f3n insegura en el componente de procesamiento de resultados de trabajos en el SDK de Amazon Braket anterior a 1.117.0 podr\u00eda permitir a un usuario remoto autenticado con acceso de escritura a S3 al bucket de salida del trabajo lograr la ejecuci\u00f3n de c\u00f3digo arbitrario en cualquier m\u00e1quina que procese los resultados del trabajo.\n\nRecomendamos actualizar a la versi\u00f3n 1.117.0 o posterior de amazon-braket-sdk."
    }
  ],
  "id": "CVE-2026-9291",
  "lastModified": "2026-07-23T12:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9291",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-22T19:03:31.240372Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-22T19:17:05.340",
  "references": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-036-aws/"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46"
    }
  ],
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary"
    }
  ]
}

GHSA-G697-2XRC-GC46

Vulnerability from github – Published: 2026-06-25 18:34 – Updated: 2026-06-25 18:34

Summary

amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

Details

Summary Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a Braket job output bucket can achieve arbitrary code execution by exploiting insecure deserialization in the job results processing component.

Impact The SDK's deserialize_values() function reads the dataFormat field directly from the job results JSON file without validation. An actor with write access to the victim's S3 job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace dataDictionary values with base64-encoded executable payloads. When the victim calls job.result(), load_job_result(), or load_job_checkpoint() as part of their normal Braket workflow, the SDK calls pickle.loads() on the actor-controlled data, executing arbitrary code with the victim's permissions.

Impacted versions: >= v1.10.0 AND < 1.117.0

Patches This issue has been addressed in amazon-braket-sdk version 1.117.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds If users cannot upgrade immediately:

Restrict S3 bucket policies on the Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have s3:PutObject permissions. This limits an an actor's ability to plant an executable payload.
Validate the dataFormat field in job result metadata before calling job.result(). Refuse to process results where the format is pickled_v4 if it did not explicitly configure pickle serialization.

References If users have any questions or comments about this advisory, amazon-braket-sdk asks that users contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "amazon-braket-sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.117.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-25T18:34:18Z",
    "nvd_published_at": "2026-05-22T19:17:05Z",
    "severity": "HIGH"
  },
  "details": "**Summary**\nAmazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a Braket job output bucket can achieve arbitrary code execution by exploiting insecure deserialization in the job results processing component.\n\n**Impact**\nThe SDK\u0027s deserialize_values() function reads the dataFormat field directly from the job results JSON file without validation. An actor with write access to the victim\u0027s S3 job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace dataDictionary values with base64-encoded executable payloads. When the victim calls job.result(), load_job_result(), or load_job_checkpoint() as part of their normal Braket workflow, the SDK calls pickle.loads() on the actor-controlled data, executing arbitrary code with the victim\u0027s permissions.\n\n**Impacted versions**: \u003e= v1.10.0 AND \u003c 1.117.0\n\n**Patches**\nThis issue has been addressed in amazon-braket-sdk version 1.117.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n**Workarounds**\nIf users cannot upgrade immediately:\n\n1. Restrict S3 bucket policies on the Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have s3:PutObject permissions. This limits an an actor\u0027s ability to plant an executable payload.\n2. Validate the dataFormat field in job result metadata before calling job.result(). Refuse to process results where the format is pickled_v4 if it did not explicitly configure pickle serialization.\n\n**References**\nIf users have any questions or comments about this advisory, amazon-braket-sdk asks that users contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "id": "GHSA-g697-2xrc-gc46",
  "modified": "2026-06-25T18:34:18Z",
  "published": "2026-06-25T18:34:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9291"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-036-aws"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()"
}

PYSEC-2026-2342

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:03

Details

Impacted versions: >= v1.10.0 AND < 1.117.0

Workarounds If users cannot upgrade immediately:

Restrict S3 bucket policies on the Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have s3:PutObject permissions. This limits an an actor's ability to plant an executable payload.
Validate the dataFormat field in job result metadata before calling job.result(). Refuse to process results where the format is pickled_v4 if it did not explicitly configure pickle serialization.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impacted products

Name	purl
amazon-braket-sdk	pkg:pypi/amazon-braket-sdk

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "amazon-braket-sdk",
        "purl": "pkg:pypi/amazon-braket-sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.117.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0",
        "1.100.0",
        "1.100.1",
        "1.101.0",
        "1.101.0.post0",
        "1.102.0",
        "1.102.1",
        "1.102.10",
        "1.102.2",
        "1.102.3",
        "1.102.4",
        "1.102.5",
        "1.102.6",
        "1.102.7",
        "1.102.8",
        "1.102.9",
        "1.103.0",
        "1.104.0",
        "1.104.1",
        "1.105.0",
        "1.106.0",
        "1.106.1",
        "1.106.2",
        "1.106.3",
        "1.106.4",
        "1.106.5",
        "1.107.0",
        "1.108.0",
        "1.108.1",
        "1.109.0",
        "1.11.0",
        "1.11.1",
        "1.110.0",
        "1.110.1",
        "1.111.0",
        "1.111.1",
        "1.111.2",
        "1.112.0",
        "1.112.1",
        "1.113.0",
        "1.113.1",
        "1.114.0",
        "1.115.0",
        "1.116.0",
        "1.12.0",
        "1.13.0",
        "1.14.0",
        "1.14.0.post0",
        "1.15.0",
        "1.16.0",
        "1.16.1",
        "1.17.0",
        "1.18.0",
        "1.18.0.post0",
        "1.18.1",
        "1.18.2",
        "1.19.0",
        "1.20.0",
        "1.21.0",
        "1.21.1",
        "1.22.0",
        "1.23.0",
        "1.23.1",
        "1.23.2",
        "1.24.0",
        "1.25.0",
        "1.25.1",
        "1.25.1.post0",
        "1.25.2",
        "1.26.0",
        "1.26.1",
        "1.26.2",
        "1.27.0",
        "1.27.1",
        "1.28.0",
        "1.28.1",
        "1.29.0",
        "1.29.0.post0",
        "1.29.1",
        "1.29.2",
        "1.29.3",
        "1.29.4",
        "1.30.0",
        "1.30.1",
        "1.30.2",
        "1.31.0",
        "1.31.1",
        "1.32.0",
        "1.32.1",
        "1.32.1.post0",
        "1.33.0",
        "1.33.0.post0",
        "1.33.1",
        "1.33.2",
        "1.34.0",
        "1.34.1",
        "1.34.2",
        "1.34.3",
        "1.34.3.post0",
        "1.35.0",
        "1.35.1",
        "1.35.2",
        "1.35.3",
        "1.35.4",
        "1.35.4.post0",
        "1.35.5",
        "1.36.0",
        "1.36.1",
        "1.36.2",
        "1.36.2.post0",
        "1.36.3",
        "1.36.4",
        "1.36.5",
        "1.37.0",
        "1.37.1",
        "1.38.0",
        "1.38.1",
        "1.38.2",
        "1.38.3",
        "1.39.0",
        "1.39.1",
        "1.40.0",
        "1.41.0",
        "1.42.0",
        "1.42.1",
        "1.42.2",
        "1.43.0",
        "1.44.0",
        "1.45.0",
        "1.46.0",
        "1.47.0",
        "1.48.0",
        "1.48.1",
        "1.49.0",
        "1.49.1",
        "1.49.1.post0",
        "1.50.0",
        "1.51.0",
        "1.52.0",
        "1.53.0",
        "1.53.0.post0",
        "1.53.1",
        "1.53.2",
        "1.53.3",
        "1.53.4",
        "1.54.0",
        "1.54.1",
        "1.54.2",
        "1.54.3",
        "1.54.3.post0",
        "1.55.0",
        "1.55.1",
        "1.55.1.post0",
        "1.56.0",
        "1.56.1",
        "1.56.2",
        "1.57.0",
        "1.57.1",
        "1.57.2",
        "1.58.0",
        "1.58.1",
        "1.59.0",
        "1.59.1",
        "1.59.1.post0",
        "1.59.2",
        "1.60.2",
        "1.61.0",
        "1.61.0.post0",
        "1.62.0",
        "1.62.1",
        "1.63.0",
        "1.64.0",
        "1.64.1",
        "1.64.2",
        "1.65.0",
        "1.65.1",
        "1.66.0",
        "1.67.0",
        "1.68.0",
        "1.68.1",
        "1.68.2",
        "1.68.3",
        "1.69.0",
        "1.69.1",
        "1.70.0",
        "1.70.1",
        "1.70.2",
        "1.70.3",
        "1.71.0",
        "1.72.0",
        "1.72.1",
        "1.72.2",
        "1.73.0",
        "1.73.1",
        "1.73.2",
        "1.73.3",
        "1.74.0",
        "1.74.1",
        "1.75.0",
        "1.76.0",
        "1.76.1",
        "1.76.2",
        "1.76.3",
        "1.77.0",
        "1.77.1",
        "1.77.2",
        "1.77.3",
        "1.77.3.post0",
        "1.77.4",
        "1.77.5",
        "1.77.6",
        "1.78.0",
        "1.79.0",
        "1.79.1",
        "1.80.0",
        "1.80.1",
        "1.81.0",
        "1.81.1",
        "1.82.0",
        "1.83.0",
        "1.84.0",
        "1.85.0",
        "1.86.0",
        "1.86.1",
        "1.87.0",
        "1.87.1",
        "1.88.0",
        "1.88.1",
        "1.88.2",
        "1.88.2.post0",
        "1.88.3",
        "1.89.0",
        "1.89.1",
        "1.90.0",
        "1.90.1",
        "1.90.2",
        "1.91.0",
        "1.91.1",
        "1.91.2",
        "1.92.0",
        "1.93.0",
        "1.94.0",
        "1.95.0",
        "1.96.0",
        "1.96.1",
        "1.97.0",
        "1.98.0",
        "1.99.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9291",
    "GHSA-g697-2xrc-gc46"
  ],
  "details": "**Summary**\nAmazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a Braket job output bucket can achieve arbitrary code execution by exploiting insecure deserialization in the job results processing component.\n\n**Impact**\nThe SDK\u0027s deserialize_values() function reads the dataFormat field directly from the job results JSON file without validation. An actor with write access to the victim\u0027s S3 job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace dataDictionary values with base64-encoded executable payloads. When the victim calls job.result(), load_job_result(), or load_job_checkpoint() as part of their normal Braket workflow, the SDK calls pickle.loads() on the actor-controlled data, executing arbitrary code with the victim\u0027s permissions.\n\n**Impacted versions**: \u003e= v1.10.0 AND \u003c 1.117.0\n\n**Patches**\nThis issue has been addressed in amazon-braket-sdk version 1.117.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n**Workarounds**\nIf users cannot upgrade immediately:\n\n1. Restrict S3 bucket policies on the Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have s3:PutObject permissions. This limits an an actor\u0027s ability to plant an executable payload.\n2. Validate the dataFormat field in job result metadata before calling job.result(). Refuse to process results where the format is pickled_v4 if it did not explicitly configure pickle serialization.\n\n**References**\nIf users have any questions or comments about this advisory, amazon-braket-sdk asks that users contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "id": "PYSEC-2026-2342",
  "modified": "2026-07-13T16:03:21.334783Z",
  "published": "2026-07-13T15:46:23.987703Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-g697-2xrc-gc46"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9291"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-036-aws"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/amazon-braket-sdk"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-g697-2xrc-gc46"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-9291 (GCVE-0-2026-9291)

FKIE_CVE-2026-9291

GHSA-G697-2XRC-GC46

PYSEC-2026-2342

Tags

Sightings

Nomenclature

Related by attack behaviour