Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-126087— Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent

Quick assessment

Affected
AWS openjd-sessions
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 系统上，Open Job Description (OpenJD) Sessions 0.11.0 之前版本中，Python 跨用户进程启动器存在不可信搜索路径漏洞。该漏洞影响 AWS Deadline Cloud 0.33.0 之前版本的 Worker Agent。若攻击者已认证并拥有向队列提交作业的权限，可通过构造恶意作业修改 PATH 环境变量，从而以 Worker Agent 操作系统用户身份执行任意代码，并窃取该 Agent 持有的 AWS 凭证。 为修复此问题，由客户自行管理的集群用户应

CVSS 8.8 · High

Possible ATT&CK Techniques 2 AI

T1055.012 · Process Hollowing T1203.002

Affected Version Matrix 2

VendorProduct Version RangeStatus
AWS deadline-cloud-worker-agent < 0.33.0 affected
AWS openjd-sessions < 0.11.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-126087

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent
Source: CVE Program / CVE List V5
Vulnerability Description
Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable. To remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AWS openjd-sessions 0 ~ 0.11.0 -
AWS deadline-cloud-worker-agent 0 ~ 0.33.0 -

II. Public POCs for CVE-2026-126087

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-126087

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-126087 (1)

Vendor Pages for CVE-2026-126087 (2)

IV. Related Vulnerabilities

Same vendor: AWS
Same weakness: CWE-426