CVE-2026-14904 AWS CVE debrief

Who should care

Users of AWS Research and Engineering Studio (RES) should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating SSH private key files and permissions, monitoring for suspicious activity on the cluster-manager EC2 instance, and upgrading to RES version 2026.06. Operators, platform administrators, and security teams should review the affected scope and severity to determine the necessary actions.

Technical summary

The Auth.GetUserPrivateKey API in AWS Research and Engineering Studio (RES) has an improper link resolution before file access issue (CWE-59). An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. This vulnerability can be mitigated by upgrading to RES version 2026.06 and reviewing SSH private key files and permissions.

Defensive priority

High

Recommended defensive actions

• Upgrade to RES version 2026.06
• Review and update SSH private key files and permissions
• Monitor for suspicious activity on the cluster-manager EC2 instance
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-07T17:16:35.627Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Auth.GetUserPrivateKey API in AWS Research and Engineering Studio (RES) has an improper link resolution before file access issue (CWE-59).

Official resources