Insecure Deserialization in Amazon Braket SDK Job Results Processing

Bulletin ID:  2026-036-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  05/22/2026 11:15 AM PDT Description: Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. We identified CVE-2026-9291 , an insecure deserialization issue (CWE-502) in the job results processing component. The SDK's deserialize_values() function trusts the dataFormat field from an untrusted JSON file to control whether pickle.loads() is called on the data payload. A remote authenticated user with S3 write access to the job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace data values with executable payloads, achieving arbitrary code execution on any machine that processes job results. Impacted versions:  >= 1.10.0 AND Resolution: This issue has been addressed in amazon-braket-sdk version 1.117.0 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If you cannot upgrade immediately, restrict S3 bucket policies on your Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have write permissions. Additionally, you can validate the dataFormat field in job result metadata before calling job.result() and refuse to process results with an unexpected format. References: CVE-2026-9291 GHSA-g697-2xrc-gc46 Please email  aws-security@amazon.com  with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-036-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-9291 - Insecure Deserialization in Amazon Braket SDK Job Results Processing Bulletin ID:  2026-036-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  05/22/2026 11:15 AM PDT Description: Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. We identified CVE-2026-9291 , an insecure deserialization issue (CWE-502) in the job results processing component. The SDK's deserialize_values() function trusts the dataFormat field from an untrusted JSON file to control whether pickle.loads() is called on the data payload. A remote authenticated user with S3 write access to the job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace data values with executable payloads, achieving arbitrary code execution on any machine that processes job results. Impacted versions:  >= 1.10.0 AND Resolution: This issue has been addressed in amazon-braket-sdk version 1.117.0 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If you cannot upgrade immediately, restrict S3 bucket policies on your Braket job output buckets to enforce least-privilege access, ensuring only trusted principals have write permissions. Additionally

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Severity from

NVD

• aws.amazon.com/security/security-bulletins/rss/2026-036-aws/
• www.cve.org/CVERecord?id=CVE-2026-9291