CVE-2026-124034

6.4 MEDIUMpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys. We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Weaknesses

CWE-23

Public exploit & PoC references

https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.127.7
https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-4hhf-mfx9-3877

All references

https://aws.amazon.com/security/security-bulletins/2026-175-aws/
https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.127.7
https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-4hhf-mfx9-3877

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-101024PoC
UNSCOREDCVE-2026-102252PoC
HIGHCVE-2026-103278PoC
UNSCOREDCVE-2026-103508
UNSCOREDCVE-2026-103663
UNSCOREDCVE-2026-104620
MEDIUMCVE-2026-105275PoC
HIGHCVE-2026-105505

Related by shared AI tags and CWE weakness class. Browse the full archive.