MEDIUM 5.9 NVD
CVE-2026-124034
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write ac
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.
References
- https://aws.amazon.com/security/security-bulletins/2026-175-aws/
- https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.127.7
- https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-4hhf-mf
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.