Datadog releases pathrunner framework for AWS IAM privilege escalation
Datadog Security Labs launched pathrunner, a modular tool that automates the exploitation of AWS IAM privilege escalation paths to help defenders prioritize remediation.
Key points
- pathrunner automates the exploitation of AWS IAM privilege escalation paths defined in pathfinding.cloud.
- The framework allows security teams to demonstrate the impact of misconfigurations by simulating attacks.
- Datadog released pathrunner following the launch of pathfinding.cloud and Pathfinding Labs in 2025 and 2026.
Datadog Security Labs released pathrunner, a modular offensive security framework designed to automate the exploitation of AWS Identity and Access Management (IAM) privilege escalation paths. The tool helps security teams identify and prioritize exploitable misconfigurations by demonstrating the actual impact of an attack within a cloud environment.
The framework is built to exploit the specific permission sets that allow an AWS IAM principal to gain access to another principal, as defined in the pathfinding.cloud catalog. According to Datadog, pathrunner enables defenders to triage security vulnerabilities and misconfigurations by showing exactly how they can be exploited, rather than just listing missing best practices.
Context and Background
Datadog introduced pathfinding.cloud in December 2025 as a catalog of AWS IAM privilege escalation techniques. The company followed this with Pathfinding Labs in May 2026, providing intentionally vulnerable AWS environments that users can deploy in a sandbox account to practice exploitation. pathrunner serves as the offensive tool that automates the exploitation of the paths defined in the catalog and instantiated in the labs.
Full documentation for pathrunner, including all commands and exploit modules, is available at pathfinding.cloud/pathrunner. The tool is designed to assist both defensive and offensive security teams in understanding the exploitability of misconfigurations, similar to how Proof of Concept exploits increase the severity of software vulnerability findings.
Who Is Affected
Cloud security defenders and penetration testers who manage AWS environments are the primary audience for this tool. According to Datadog, defenders often face more vulnerabilities and misconfigurations than they have time to resolve, making it necessary to carefully choose where to spend remediation efforts. pathrunner helps these teams pinpoint specific exploitable misconfigurations by simulating real-world attack scenarios.
The framework addresses the shift in attack patterns from traditional on-premises Active Directory environments to cloud-native settings. In cloud environments, attackers often hop from one cloud identity to another by accessing credentials, rather than pivoting through workloads via TCP sessions. pathrunner is designed to reflect this identity-centric attack model.
What should you do?
Security teams should review their AWS IAM permissions to identify any principals that may have the ability to escalate privileges to other identities. Organizations can use pathrunner in isolated sandbox environments to test their current configurations and determine which misconfigurations are actively exploitable. Defenders should prioritize remediation efforts based on the impact demonstrated by these simulated attacks.
What to do and how to stay safe: Datadog
- Audit AWS IAM policies to identify principals with permissions that could allow access to other identities or resources.
- Deploy pathrunner in a segregated sandbox environment to test for exploitable misconfigurations without affecting production systems.
- Prioritize remediation of misconfigurations that pathrunner identifies as actively exploitable, focusing on high-impact paths.
- Monitor for unauthorized identity switches or credential access attempts that may indicate an attacker is using similar techniques.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is pathrunner?
pathrunner is a modular, cloud-native offensive security framework released by Datadog Security Labs that automates the exploitation of AWS IAM privilege escalation paths.
How does pathrunner help defenders?
It demonstrates the impact of specific misconfigurations by simulating attacks, allowing defenders to prioritize remediation based on exploitability rather than just best practices.
Is pathrunner available for public use?
Yes, Datadog has released pathrunner to the public, with full documentation and commands available at pathfinding.cloud/pathrunner.
