HIGHCVE-2026-9291Published Modified CNA AMZN
CVE-2026-9291: Insecure Deserialization in Amazon Braket SDK Job Results Processing
Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results. We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.
Metrics
- CVSS v4.0
- 7.5
- Severity
- HIGH
- Fixed in
- 1.117.0
- Affected Products
- 1
Affected packages
- AWS / Amazon Braket Python SDK< 1.117.0 (from 1.10.0)
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences