AWS Research Studio Fixes CVE-2026-14904 File Read Flaw in Auth API

AWS released a security bulletin on July 7, 2026, addressing a file-read vulnerability in its Research and Engineering Studio solution. The issue, tracked as CVE-2026-14904, involves improper link resolution within the Auth.GetUserPrivateKey API, allowing authenticated remote users to access sensitive data on cluster-manager EC2 instances.

An attacker could exploit this flaw by replacing their SSH private key file, typically located at ~/.ssh/id_rsa, with a symbolic link targeting any file on the host system. Because the cluster-manager process runs with root privileges, this technique exposes any file readable by the root user, including other users' SSH private keys and application configuration secrets.

Context and Background

AWS Research and Engineering Studio is an open-source solution designed to help researchers and engineers create and manage secure virtual desktops and computing resources on the AWS platform. The vulnerability arises from the way the application handles file access during the authentication process, specifically when retrieving private keys for user sessions.

The bulletin classifies the issue as important and requiring attention. It highlights that the improper link resolution before file access creates a security risk for environments using the affected versions of the software. The flaw allows for the escalation of read privileges to the root level of the cluster-manager instance.

Who Is Affected

Any organization using AWS Research and Engineering Studio versions prior to 2026.06 is potentially affected by this vulnerability. Users who have forked or created derivative code from the original repository must also ensure their custom versions incorporate the new fixes. The risk is present for any authenticated remote user interacting with the vulnerable API endpoint.

AWS confirmed that the issue has been addressed in RES version 2026.06. The vendor recommends upgrading to the latest version immediately to mitigate the risk. For customers unable to upgrade immediately, patch scripts are available for the past three major versions, with detailed instructions on the RES GitHub wiki.

What should you do?

Security teams should verify their current version of AWS Research and Engineering Studio against the released fix. If running an older version, administrators should apply the available patch scripts or upgrade to version 2026.06 as soon as possible. Organizations using custom forks should review their code to ensure the improper link resolution issue is resolved.

What to do and how to stay safe: AWS

• Check your current version of AWS Research and Engineering Studio to determine if it is vulnerable to CVE-2026-14904.
• Upgrade to RES version 2026.06 or apply the provided patch scripts for the previous three major versions.
• Review any forked or derivative code to ensure the fix for the Auth.GetUserPrivateKey API is incorporated.
• Monitor the RES GitHub wiki for detailed patching instructions and any further security updates from AWS.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-14904?

It is an improper link resolution vulnerability in the Auth.GetUserPrivateKey API of AWS Research and Engineering Studio that allows authenticated users to read arbitrary files.

Which versions of AWS Research and Engineering Studio are affected?

Versions prior to 2026.06 are affected. Patch scripts are available for the three major versions preceding the fix.

How can an attacker exploit this vulnerability?

An attacker can replace their SSH private key file with a symbolic link to any file on the host, leveraging the root privileges of the cluster-manager process to read sensitive data.