Is CVE-2026-124035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124035 being exploited in the wild.

How severe is CVE-2026-124035?

High severity, with a CVSS score of 7.1, published 9 November 2026.

Which products and versions are affected?

Amazon Braket Schemas 1.17.0 to before 1.32.2.

Is there a fix for CVE-2026-124035?

Yes: fixed in 1.32.2. Until then: Restrict S3 write access to Braket task-output locations to only trusted principals and limit the IAM role permissions for job execution. [{"kind": "disclosed", "at": "2026-11-09"}, {"kind": "patched", "at": "2026-11-09", "note": "version 1.32.2 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124035 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124035?

Check whether you run Amazon Braket Schemas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124035: Amazon Braket Schemas unsafe reflection in error mitigation validation

CVE-2026-124035 · Severity: high · CVSS 7.1 · Published 2026-11-09

Amazon Braket Schemas is a Python library used to parse quantum task results in AWS's quantum computing service. An attacker with S3 write access to a task's output location can inject a malicious task result document that executes arbitrary code on any machine retrieving those results, potentially compromising quantum computing infrastructure and related systems.

Vendors: Amazon.

Quick answers

Is CVE-2026-124035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124035 being exploited in the wild.
How severe is CVE-2026-124035?: High severity, with a CVSS score of 7.1, published 9 November 2026.
Which products and versions are affected?: Amazon Braket Schemas 1.17.0 to before 1.32.2.
Is there a fix for CVE-2026-124035?: Yes: fixed in 1.32.2. Until then: Restrict S3 write access to Braket task-output locations to only trusted principals and limit the IAM role permissions for job execution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-09"}, {"kind": "patched", "at": "2026-11-09", "note": "version 1.32.2 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124035 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124035?: Check whether you run Amazon Braket Schemas at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.32.2

Restrict S3 write access to Braket task-output locations to only trusted principals and limit the IAM role permissions for job execution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-09"}, {"kind": "patched", "at": "2026-11-09", "note": "version 1.32.2 released"}]

Technical details

Unsafe reflection in the error mitigation schema validation allows code execution via deserialization of untrusted data. An authenticated attacker with S3 write access to the quantum task output location can supply a crafted task result document that exploits reflection-based deserialization to execute arbitrary Python code when the result is retrieved and parsed. The fix (v1.32.2) replaces unsafe import_module reflection with an allowlist-based validation approach.

Affected products

Amazon Braket Schemas 1.17.0 to before 1.32.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.