Symlink File Read Vulnerability in AWS Research and Engineering Studio

Executive Summary

CVE-2026-14904 is an improper link resolution vulnerability (CWE-59) in the Auth.GetUserPrivateKey API of AWS Research and Engineering Studio (RES).

An authenticated remote user can exploit this flaw by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link that points to any file on the cluster-manager EC2 instance.

Because the cluster-manager process runs with root privileges, this allows the attacker to read arbitrary files on the host, including sensitive files such as other users' SSH private keys and application configuration secrets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information on the cluster-manager EC2 instance.

• An attacker with authenticated access can read arbitrary files, potentially exposing other users' SSH private keys.
• Application configuration secrets stored on the host may also be exposed.

Such exposure can compromise the security of the system and other users, potentially leading to further attacks or data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, it is recommended to upgrade AWS Research and Engineering Studio (RES) to version 2026.06 or later, where the issue has been fixed.

For users who cannot upgrade immediately, patch scripts are available for the past three major versions, with detailed instructions provided on the RES GitHub wiki.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated remote user to read arbitrary files on the cluster-manager EC2 instance, including sensitive files such as other users' SSH private keys and application configuration secrets. This exposure of sensitive data could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Because the cluster-manager process runs as root, the impact is significant in terms of confidentiality, which is a core requirement in many compliance frameworks. Organizations using AWS Research and Engineering Studio (RES) should upgrade to version 2026.06 or apply available patches to mitigate this risk and maintain compliance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to arbitrary files on the cluster-manager EC2 instance. Detection involves checking for unexpected symbolic links in the SSH private key location and monitoring for unauthorized file access attempts by the cluster-manager process running as root.

Suggested commands to detect potential exploitation or presence of this vulnerability include:

• Check if the SSH private key file is a symbolic link: ls -l ~/.ssh/id_rsa
• Find all symbolic links in users' .ssh directories that could be exploited: find /home -type l -path '*/.ssh/id_rsa'
• Audit recent file access by the cluster-manager process (running as root) using system audit tools like auditd or by checking logs for suspicious reads.
• Monitor for unusual file read operations or symbolic link creations in the cluster-manager environment.

Upgrading to RES version 2026.06 or later is recommended to remediate this vulnerability.

Useful 0 Not Useful 0