7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9291

CVE-2026-9291: Insecure Deserialization in Amazon Braket SDK Job Results Processing

Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.

We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9291

CVE-2026-9291:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
amazon-braket-sdk	pip	>= 1.10.0, < 1.117.0	1.117.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic insecure deserialization issue within the amazon-braket-sdk. The root cause lies in the braket.jobs.serialization.deserialize_values function, which used Python's pickle.loads() to deserialize job result data. The SDK would use this function if the dataFormat field in the results.json file was set to pickled_v4. An attacker with write permissions to the S3 bucket where job results are stored could modify this JSON file, setting the dataFormat and providing a base64-encoded malicious pickle object as the data. When a user or automated process later attempts to retrieve these results via the SDK by calling functions like job.result(), load_job_result(), or load_job_checkpoint(), the malicious object would be deserialized, leading to arbitrary code execution with the privileges of the process running the SDK. The patch mitigates this by disabling pickle deserialization by default. A new allow_pickle=False parameter was introduced to deserialize_values and all calling functions. The SDK now raises a RuntimeError if it encounters pickled data unless the user explicitly opts in by setting allow_pickle=True, thus preventing the exploit by default.

Vulnerable functions

braket.jobs.serialization.deserialize_values

src/braket/jobs/serialization.py

This function is the root cause of the vulnerability. It directly uses `pickle.loads` to deserialize data from the `data_dictionary` if the `data_format` is `PICKLED_V4`. An attacker can control the contents of `data_dictionary` by modifying job result files in S3, leading to arbitrary code execution.

braket.jobs.data_persistence.load_job_result

src/braket/jobs/data_persistence.py

This function is a direct entry point for the vulnerability. It reads persisted job data and calls the vulnerable `deserialize_values` function without any mechanism to prevent pickle deserialization, allowing an attacker to trigger code execution by crafting a malicious job result file.

braket.jobs.data_persistence.load_job_checkpoint

src/braket/jobs/data_persistence.py

Similar to `load_job_result`, this function is another entry point for the vulnerability. It loads job checkpoint data and passes it to the vulnerable `deserialize_values` function, which can lead to arbitrary code execution if the checkpoint data is malicious.

braket.aws.aws_quantum_job.AwsQuantumJob.result

src/braket/aws/aws_quantum_job.py

This is a high-level, user-facing method to retrieve job results. It orchestrates the process of downloading results from S3 and processing them, which ultimately leads to a call to the vulnerable `deserialize_values` function. An attacker can exploit this by placing a malicious result file in the expected S3 location.

braket.jobs.local.local_job.LocalQuantumJob.result

src/braket/jobs/local/local_job.py

This method is the equivalent of `AwsQuantumJob.result` but for jobs running in a local environment. It reads the `results.json` file from the local filesystem and calls the vulnerable `deserialize_values` function, making it an entry point for the vulnerability in a local context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.