AWSAWS-2026-177

Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker...

CVE-2026-126087 · Published Nov 10, 2026

High8.8

No fix yet

Bulletin ID: 2026-177-AWS Publication Date: 11/10/2026 10:45 AM PST Description: Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable. Impacted versions: - openjd-sessions < 0.11.0 - deadline-cloud-worker-agent < 0.33.0 Refer to the article for the most up-to-date and complete information.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityNov 11Severity: Unrated to High

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: NVD

More AWS advisories

All AWS

Medium 5.5Nov 10

Incorrect default permissions on session transcripts and prompt history in Kiro CLICVE-2026-124848no fix yet High 7.8Nov 10

AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationCVE-2026-125271no fix yet Medium 6.4Nov 9

Issues with Amazon Braket SDKCVE-2026-124034no fix yet Medium 6.4Nov 9

Relative path traversal in the log export commands in AWS ParallelCluster CLICVE-2026-124033no fix yet Critical 9.8Nov 6

Issues with Babelfish for Aurora PostgreSQLCVE-2026-119923no fix yet Critical 9.9Nov 6

Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM...CVE-2026-122193no fix yet