CVE-2026-9291: Amazon Braket SDK RCE Vulnerability

CVE-2026-9291 Overview

CVE-2026-9291 is an insecure deserialization vulnerability in the Amazon Braket SDK affecting versions prior to 1.117.0. The flaw resides in the job results processing component, which deserializes data retrieved from the S3 job output bucket. A remote authenticated user with S3 write access to the job output bucket can craft malicious serialized payloads. When the SDK processes those results, the attacker achieves arbitrary code execution on any machine that handles the output. The weakness is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Authenticated attackers with write access to a Braket job output bucket can execute arbitrary code on every machine that processes the job results, including developer workstations and downstream automation hosts.

Affected Products

Amazon Braket SDK (Python) versions prior to 1.117.0
Workstations and pipelines that consume Braket job outputs from S3
Automation services invoking amazon-braket-sdk for result retrieval

Discovery Timeline

2026-05-22 - CVE-2026-9291 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-9291

Vulnerability Analysis

The Amazon Braket SDK orchestrates quantum computing jobs on AWS and retrieves results from a customer-controlled S3 bucket. The job results processing component deserializes objects fetched from that bucket without sufficient validation of the data source or content. Because deserialization can instantiate arbitrary objects and trigger object construction logic, a malicious payload placed in the output bucket leads to code execution inside the calling process. The exploitation path runs in the security context of the user or service invoking the SDK, which often holds broader AWS credentials and local privileges than the original job runner.

Root Cause

The root cause is the use of an unsafe deserializer on untrusted S3 content within the result-handling logic. The SDK treats objects in the job output bucket as trusted by virtue of their location, even though S3 write permissions on that bucket may be delegated to less privileged identities. This violates the [CWE-502] principle that deserialization must only occur on data whose integrity and origin are verified.

Attack Vector

An attacker requires AWS-authenticated access with s3:PutObject permission on the job output bucket. The attacker writes a crafted serialized object in place of, or alongside, legitimate job artifacts. When a developer, CI/CD job, or downstream consumer runs the Braket SDK to fetch and process results, the malicious payload deserializes and executes attacker-controlled code. The vector is network-reachable but requires both authentication and user action to process the poisoned results.

No public proof-of-concept code has been published. See the GitHub Security Advisory GHSA-g697-2xrc-gc46 for vendor technical details.

Detection Methods for CVE-2026-9291

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running amazon-braket-sdk result-processing functions.
S3 PutObject events to Braket job output buckets from principals that are not the Braket job execution role.
Outbound network connections from hosts immediately after Braket result retrieval, particularly to non-AWS endpoints.
Modifications to job artifact files in S3 between job completion and result download.

Detection Strategies

Inspect CloudTrail S3 data events for writes to Braket job output buckets and compare the writing principal against the expected Braket service role.
Correlate endpoint process telemetry with Braket SDK invocations to flag interpreter processes that fork shells, package managers, or network utilities.
Hunt for Python deserialization-related stack frames in crash dumps or audit logs of machines running Braket workflows.

Monitoring Recommendations

Enable S3 server access logging and CloudTrail data events on every job output bucket used by Braket.
Forward host process, file, and network telemetry from developer workstations and CI runners into a SIEM for correlation with Braket activity.
Alert on Braket SDK versions below 1.117.0 reported by software inventory tooling.

How to Mitigate CVE-2026-9291

Immediate Actions Required

Upgrade amazon-braket-sdk to version 1.117.0 or later on every workstation, server, and pipeline that consumes Braket job results.
Audit IAM and bucket policies to ensure only the Braket service role and trusted administrators hold s3:PutObject on job output buckets.
Rotate any AWS credentials that had write access to Braket output buckets if compromise is suspected.
Review CloudTrail history for unauthorized writes to job output buckets since the buckets were created.

Patch Information

AWS released the fix in amazon-braket-sdk version 1.117.0. Refer to the GitHub Release v1.117.0 and the AWS Security Bulletin 2026-036 for the official fix and guidance.

Workarounds

Restrict s3:PutObject on Braket job output buckets to the Braket execution role only, using least-privilege bucket policies.
Enable S3 Object Lock or versioning on output buckets to detect and recover from unauthorized overwrites.
Run Braket result-processing code in isolated, ephemeral environments with no long-lived AWS credentials.
Validate object integrity using checksums or signed manifests before invoking SDK functions that deserialize results.

bash

# Configuration example
pip install --upgrade "amazon-braket-sdk>=1.117.0"
pip show amazon-braket-sdk | grep -i version