CVE-2026-9291 - Insecure Deserialization in Amazon Braket SDK Job Results Processing
Bulletin ID: 2026-036-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/22/2026 11:15 AM PDT Description: Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. We identified CVE-2026-9291, an insecure deserialization issue (CWE-502) in the job results processing component. The SDK's deserialize_values() function trusts the dataFormat field from an untrusted JSON file to control whether pickle.loads() is called on the data payload. A remote authenticated user with S3 write access to the job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickled_v4 and replace data values with executable payloads, achieving arbitrary code execution on any machine that processes job results. Impacted versions: >= 1.10.0 AND < 1.117.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CSIRTS triage
- What
- Insecure deserialization allows remote authenticated users to execute arbitrary code.
- Who is affected
- Authenticated users with S3 write access to the job output bucket in Amazon Braket SDK.
- Urgency
- Remediation is critical as it can lead to remote code execution.
- Action
- Upgrade to the latest version of Amazon Braket SDK.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Amazon Braket SDK
Get an email when a new Amazon Braket SDK advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-036-aws/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-92910.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-9291 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for - Insecure Deserialization
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-86793: SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when …nvd · 2026-09-11
- unknownCVE-2026-88054: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in…nvd · 2026-09-10
- unknownCVE-2026-88050: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSeriali…nvd · 2026-09-10
- unknownCVE-2026-88048: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerial…nvd · 2026-09-10
- highCVE-2026-82925: The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deseri…nvd · 2026-09-10
- unknownCVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Paginationaws · 2026-09-09
More from AWS Security Bulletins
- unknownCVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Syste…2026-09-10
- unknownCVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library2026-09-10
- unknownCVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK2026-09-09
- highCVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit2026-09-09
- unknownCVE-2026-18953 - Improper limitation of a pathname in AWS Transform MCP Server2026-09-09