CVE-2026-124035 - Unsafe Reflection in Amazon Braket

CVE-2026-124035 - Unsafe Reflection in Amazon Braket

CVE-2026-124035, titled “Unsafe reflection in Amazon Braket Schemas error mitigation validation,” has been rated HIGH with a CVSS 4.0 score of 7.5. 🚨

Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document. The product affected by this vulnerability is Amazon Braket Schemas. This vulnerability was published on November 9, 2026, at 11:17 p.m. and last modified on the same date and time. It is remotely exploitable.

Common Weakness Enumeration (CWE)

The Common Weakness Enumeration (CWE) categorizes common flaws that can lead to vulnerabilities. CVE-2026-124035 is associated with CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’).

Common Attack Patterns

The Common Attack Pattern Enumeration and Classification (CAPEC) describes common attributes and approaches employed by adversaries to exploit weaknesses. This vulnerability is associated with CAPEC-138: Reflection Injection.

Recommended Actions

To address this issue, users should upgrade Amazon Braket Schemas to version 1.32.2 or later. It is recommended to upgrade to amazon-braket-schemas version 1.32.2 or later. Additionally, it is advised to review access controls for S3 write permissions and validate all retrieved task result documents.

Additional Resources

Public proof-of-concept exploits published on GitHub are scanned and collected in a list. News articles mentioning CVE-2026-124035 are also tracked. A vulnerability history details the changes made to CVE-2026-124035 over time, which can be useful for understanding its evolution, severity, and other characteristics.

For more details, Read full article!