CVE-2026-9291CWE-502

Insecure Deserialization in Amazon Braket SDK Job Results Processing

High · published May 22, 2026

CVSS v4.0
7.5
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.

We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00649 · 50.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-05-22T18:12Z
EPSS history
Timeline
  • 22 MAY 18:12Z
    Insecure Deserialization in Amazon Braket SDK Job Results Processing
    cvelistv5