CVE-2026-14904 Details
Description
AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.
A vulnerability exists in AWS Research and Engineering Studio (RES) versions through 2026.03, specifically in the Auth.GetUserPrivateKey API. This issue involves improper link resolution before file access, allowing authenticated remote users to read arbitrary files from the cluster-manager EC2 instance. By replacing their SSH private key file with a symbolic link to any file on the host, users can expose files readable by root, including other users' SSH private keys and application configuration secrets.
Users are advised to upgrade to RES version 2026.06, where this vulnerability has been fixed. For those unable to upgrade immediately, patch scripts are available for the past three major versions. Detailed patching instructions can be found on the RES GitHub wiki.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-053-aws/ | AMZN | |
| https://github.com/aws/res/releases/tag/2026.06 | AMZN |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | AMZN |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | AMZN |