Which versions of Amazon Braket SDK are affected by CVE-2026-9291?

Amazon Braket Python SDK versions 1.10.0-1.116.x contain an arbitrary code execution vulnerability affecting organizations that process quantum computing job results.. A patch is available.

How to fix or mitigate CVE-2026-9291?

Within 24 hours: Identify all systems running Amazon Braket Python SDK versions 1.10.0 through 1.116.x and map S3 buckets used for Braket job output storage; review IAM policies restricting write access to these buckets. Within 7 days: Upgrade all instances to version 1.117.0 or later and audit recent job results.json files for suspicious dataFormat values. Within 30 days: implement integrity monitoring on Braket output S3 buckets, review CloudTrail logs for unauthorized bucket modifications, and update application security testing to include pickle deserialization checks.

Amazon Braket SDK CVE-2026-9291

Q: What is the CVSS score of CVE-2026-9291?

CVE-2026-9291 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-31483 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-22 AMZN

GHSA-g697-2xrc-gc46

RCE Deserialization AWS Amazon Braket Python Sdk

7.5

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Attacker needs authenticated write access to a specific victim bucket (PR:L) and a non-trivial tamper setup (AC:H); victim must trigger result processing (UI:R); pickle RCE yields full C/I/A.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 12:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 12:23 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 12:23 NVD

7.1 (HIGH) 7.5 (HIGH)

Source Code Evidence Fetched

May 22, 2026 - 19:00 vuln.today

Analysis Generated

May 22, 2026 - 19:00 vuln.today

DescriptionCVE.org

Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.

We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.

AnalysisAI

Arbitrary code execution in the Amazon Braket Python SDK (versions 1.10.0 up to but not including 1.117.0) lets a remote authenticated actor with S3 write access to a Braket job output bucket run code on any machine that later processes those job results. The SDK reads the untrusted dataFormat field from results.json and, when it is set to pickled_v4, feeds attacker-controlled data into pickle.loads(), executing code with the victim SDK user's permissions. There is no public exploit identified at time of analysis, EPSS is low (0.32%), and CISA SSVC rates exploitation as none, but the technical impact is total.

Technical ContextAI

This is a classic CWE-502 insecure deserialization flaw in Python pickle handling. Amazon Braket is AWS's managed quantum computing service, and amazon-braket-sdk (CPE cpe:2.3:a:aws:amazon_braket_python_sdk) is the open-source Python client used to submit hybrid quantum jobs and retrieve results. Job results are staged in an S3 output bucket as results.json, which carries a dataFormat field (e.g. PLAINTEXT or pickled_v4) alongside a dataDictionary. The SDK's deserialize_values() function trusts the dataFormat value without validation; when it reads pickled_v4 it base64-decodes the dataDictionary values and calls pickle.loads() on them. Because pickle deserialization can instantiate arbitrary objects and invoke __reduce__ handlers, controlling the serialized bytes yields code execution in the consuming process. The v1.117.0 fix disables pickle deserialization by default.

RemediationAI

Vendor-released patch: upgrade amazon-braket-sdk to version 1.117.0 or later (release: https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.117.0), which disables pickle deserialization by default; also patch any forked or derivative code that reuses the affected deserialization logic. If you cannot upgrade immediately, apply the vendor workarounds: tighten S3 bucket policies on Braket job output buckets to least privilege so only trusted principals hold s3:PutObject, removing an attacker's ability to plant a payload (trade-off: requires auditing existing cross-account or role grants and may break automation that writes results); and validate the dataFormat field in job result metadata before calling job.result(), refusing to process results marked pickled_v4 unless you explicitly configured pickle serialization (trade-off: requires custom pre-processing and may reject legitimate pickled results if you rely on that format). See AWS bulletin 2026-036-aws and advisory GHSA-g697-2xrc-gc46 for details.