CVE-2026-124035: Unsafe reflection in Amazon Braket Schemas error mitigation validation
Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document.
We recommend you upgrade to amazon-braket-schemas version 1.32.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-braket-schemasto a version that resolves this vulnerability.Fixed in 1.32.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Machines that retrieve quantum task results are exposed if they use Amazon Braket Schemas before 1.32.2 and process a crafted task result document. The attacker must be authenticated and have S3 write access to the quantum task output location.
Does exploitation require user interaction?
Yes. The vulnerable machine must retrieve the attacker-crafted quantum task results document. The issue can result in arbitrary code execution on that machine.
What should teams do if they cannot patch immediately?
Restrict S3 write access to quantum task output locations to trusted principals, since S3 write access is required to supply the crafted result document. Upgrade to amazon-braket-schemas 1.32.2 or later as soon as possible.