AWS patches S3-driven file overwrite in Braket and ParallelCluster

AWS patches S3-driven file overwrite in Braket and ParallelCluster

10 November 2026: AWS has fixed three flaws, rated Important, in open-source client tools where a crafted object in an S3 bucket can overwrite local files or run code: CVE-2026-124034 in amazon-braket-sdk 1.127.7, CVE-2026-124035 in amazon-braket-schemas 1.32.2, and CVE-2026-124033 in aws-parallelcluster 3.16.0. None is reported as exploited, and each is fixed by upgrading the package.

Not yet independently verified. AWS rates these Important and publishes no CVSS score in either bulletin. No exploitation has been reported. We will update this when it can be confirmed, and remove this note.

Trust that follows the bucket

All three share a shape. Someone with write access to an S3 location plants a file, and the victim is whoever later reads that location with AWS's tool. In shared research and HPC accounts, write access to those buckets is often granted broadly, because the data is treated as scratch space.

CVE-2026-124034 is in the local hybrid job input download of the Braket SDK, on versions from 1.10.0 up to 1.127.7. Crafted S3 keys can overwrite arbitrary files with the privileges of the user running the job.

CVE-2026-124035 is more serious in effect. A crafted task result document, passing through error mitigation schema validation in amazon-braket-schemas, might execute arbitrary code on any machine that retrieves the results, on versions from 1.17.0 up to 1.32.2. AWS describes it as a follow-on fix to the earlier advisory CVE-2026-9291, so a team that patched that flaw and moved on needs this upgrade as well.

ParallelCluster's log export

CVE-2026-124033 is a relative path traversal in the export-cluster-logs and export-image-logs commands of the ParallelCluster command line tool. On versions 3.0.0 up to 3.16.0, a user with write access to the log export bucket could write files outside the export directory, with the privileges of the person running the command. Administrators often run those commands with elevated rights on a workstation, which is where the risk concentrates.

Fixes and bucket policy

• amazon-braket-sdk: 1.127.7 or later
• amazon-braket-schemas: 1.32.2 or later
• aws-parallelcluster: 3.16.0 or later

These are Python packages, so a pinned version in a requirements file or container image will not move on its own. AWS's workaround in each case is to restrict write access on the relevant bucket, the Braket task output and local job input locations together with the job's IAM role, and the ParallelCluster log export bucket, to trusted principals.

Eva Crystal of XSource Security reported the Braket flaws, and Mohamed Abdelaal reported the ParallelCluster flaw.

Sources

• AWS Security Bulletin 2026-175-AWS, 9 November 2026
• AWS Security Bulletin 2026-174-AWS, 9 November 2026