CVE-2026-14904
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In AWS Research and Engineering Studio (RES), a CWE-59 vulnerability was found due to improper link resolution before file access in the Auth.GetUserPrivateKey API. An authenticated remote user can read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the host.
Risk Assessment
The risk for the organization is critical because the cluster-manager process runs as root, allowing reading of any root-readable files, including other users' SSH private keys and application configuration secrets. This could lead to privilege escalation and environment compromise.
Recommendation
It is recommended to upgrade immediately to RES version 2026.06, which includes a fix for this vulnerability. Also review and restrict access permissions to the Auth.GetUserPrivateKey API.
Other vulnerabilities in AWS Research and Engineering Studio
See all- CVE-2026-5709High
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
- CVE-2026-5708High
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
- CVE-2026-5707High
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.
Original NVD description (English source)
AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.