CVE-2026-124034: Amazon Braket SDK arbitrary file overwrite and code execution

CVE-2026-124034 · Severity: high · CVSS 6.4 · Published 2026-11-09

Amazon Braket SDK is a Python library used to run quantum computing tasks on Amazon's quantum cloud service. Two vulnerabilities allow authenticated attackers with S3 write access to either overwrite arbitrary files on a user's system or execute arbitrary code when quantum task results are retrieved, potentially compromising the entire machine running the job.

Technologies: Amazon AWS. Vendors: Amazon.

Quick answers

Is CVE-2026-124034 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-124034 being exploited in the wild.
How severe is CVE-2026-124034?
High severity, with a CVSS score of 6.4, published 9 November 2026.
Which products and versions are affected?
Amazon Braket Schemas 1.17.0 to 1.32.1; Amazon Braket SDK 1.10.0 to 1.127.6.
Is there a fix for CVE-2026-124034?
Yes: fixed in Braket SDK 1.127.7; Braket Schemas 1.32.2. Until then: Restrict S3 write access to Braket task-output and local-job input data locations to trusted principals, and limit the permissions of the IAM role used by jobs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124034 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-124034?
Check whether you run Amazon AWS, Amazon Braket Schemas or Amazon Braket SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Braket SDK 1.127.7; Braket Schemas 1.32.2

Restrict S3 write access to Braket task-output and local-job input data locations to trusted principals, and limit the permissions of the IAM role used by jobs.

Technical details

CVE-2026-124034 is a path traversal vulnerability in hybrid job input data download; an authenticated attacker with S3 write access can supply crafted object keys to overwrite arbitrary files with the privileges of the user running the job. CVE-2026-124035 is an unsafe deserialization/validation issue in the error mitigation schema parser within Amazon Braket Schemas; an authenticated attacker with S3 write access to task output can execute arbitrary code on machines retrieving results by providing a malicious task result document.

Affected products

  • Amazon Braket SDK 1.10.0 to 1.127.6
  • Amazon Braket Schemas 1.17.0 to 1.32.1

Identifiers

  • CVE-2026-124034
  • CVE-2026-124035

Timeline

  • 2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.