CVE-2026-9291: AWS Amazon Braket Python SDK insecure deserialization in job results processing

CVE-2026-9291 · Severity: high · CVSS 7.1 · Published 2026-05-22

The Amazon Braket SDK is a tool used by developers to interact with quantum computing services. A security flaw in how the tool processes job results allows an attacker with specific access to a user's storage (S3 bucket) to run malicious code on the user's computer. This could lead to a full system takeover or theft of sensitive data when a user attempts to view their quantum computing results.

Technologies: Amazon AWS. Vendors: Amazon, Amazon Web Services, AWS, PyPI.

Quick answers

Is CVE-2026-9291 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9291 being exploited in the wild.
How severe is CVE-2026-9291?
High severity, with a CVSS score of 7.1, published 22 May 2026.
Which products and versions are affected?
Amazon Web Services Braket SDK >= 1.10.0, < 1.117.0; AWS Braket Python SDK >= 1.10.0, < 1.117.0; amazon-braket-sdk (PyPI) >= 1.10.0, < 1.117.0, ECOSYSTEM:introduced=1.10.0,fixed=1.117.0.
Is there a fix for CVE-2026-9291?
Yes. amazon-braket-sdk (PyPI): upgrade to 1.117.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9291 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9291?
Check whether you run Amazon AWS, Amazon Web Services Braket SDK, AWS Braket Python SDK or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • amazon-braket-sdk (PyPI): upgrade to 1.117.0 or later
    pip install "amazon-braket-sdk>=1.117.0"

Technical details

An insecure deserialization vulnerability (CWE-502) exists in the Amazon Braket SDK's deserialize_values() function. The SDK trusts the 'dataFormat' field within a job's results.json file; an attacker with s3:PutObject permissions on the job output bucket can change this field to 'pickled_v4' and provide a base64-encoded malicious pickle payload. When a victim calls functions such as job.result(), load_job_result(), or load_job_checkpoint(), the SDK executes pickle.loads() on the untrusted data, leading to arbitrary code execution. This requires the attacker to have authenticated access to the S3 bucket and for the victim to interactively process the compromised job results. The issue is fixed in version 1.117.0 by disabling pickle deserialization by default.

Affected products

  • AWS Amazon Braket Python SDK >= 1.10.0, < 1.117.0

Identifiers

  • CVE-2026-9291
  • GHSA-g697-2xrc-gc46
  • PYSEC-2026-2342

Timeline

  • 2026-04-24: patched: Version 1.117.0 released on GitHub
  • 2026-05-22: advisory: AWS and NVD published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.