CVE-2026-124034
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 objec
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.