CVE-2026-124034: Path traversal in Amazon Braket SDK local hybrid job input data download
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-braket-sdkto a version that resolves this vulnerability.Fixed in 1.127.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running local hybrid jobs with Amazon Braket SDK versions before 1.127.7 are exposed if an attacker has write access to the S3 location used for that job's input data. The impact is limited to the privileges of the user account running the job.
What does an attacker need to exploit it?
The attacker needs authenticated S3 write access to the hybrid job input-data location and must provide crafted S3 object keys. Exploitation also requires a user to run the affected local hybrid job.
What is the recommended remediation?
Upgrade amazon-braket-sdk to version 1.127.7 or later. If an immediate upgrade is not possible, restrict S3 write access to hybrid job input-data locations to trusted principals.