CVE-2026-124034 Path traversal in Amazon Braket SDK local hybrid job input data download
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124034?
CVE-2026-124034 is a medium-severity vulnerability in AWS amazon-braket-sdk, published on 9 Nov 2026.
Official description
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.
Weakness: CWE-23
Which versions are affected by CVE-2026-124034?
How do I fix CVE-2026-124034?
No fix has been published for CVE-2026-124034 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124034 being exploited?
There is no known exploitation of CVE-2026-124034 in the wild and no public exploit code.
Sources
Also known as GHSA-4hhf-mfx9-3877.