Executive brief
The Amazon Braket SDK is a tool used by developers to interact with quantum computing services. A security flaw in how the tool processes job results allows an attacker with specific access to a user's storage (S3 bucket) to run malicious code on the user's computer. This could lead to a full system takeover or theft of sensitive data when a user attempts to view their quantum computing results.
Technical details
An insecure deserialization vulnerability (CWE-502) exists in the Amazon Braket SDK's deserialize_values() function. The SDK trusts the 'dataFormat' field within a job's results.json file; an attacker with s3:PutObject permissions on the job output bucket can change this field to 'pickled_v4' and provide a base64-encoded malicious pickle payload. When a victim calls functions such as job.result(), load_job_result(), or load_job_checkpoint(), the SDK executes pickle.loads() on the untrusted data, leading to arbitrary code execution. This requires the attacker to have authenticated access to the S3 bucket and for the victim to interactively process the compromised job results. The issue is fixed in version 1.117.0 by disabling pickle deserialization by default.
Affected products
- AWS Amazon Braket Python SDK >= 1.10.0, < 1.117.0
Timeline
- 2026-04-24: patched: Version 1.117.0 released on GitHub
- 2026-05-22: advisory: AWS and NVD published advisory details