CVE-2026-14904: RES Auth.GetUserPrivateKey Arbitrary File Read
AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS.
Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/idrsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets.
It's recommended to upgrade to RES version 2026.06.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Research and Engineering Studio (RES)to a version that resolves this vulnerability.Fixed in 2026.06
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14904?
CVE-2026-14904 has a medium severity rating of 6.5.
How do I fix CVE-2026-14904?
To fix CVE-2026-14904, update to the latest version of AWS Research and Engineering Studio (RES) that addresses this vulnerability.
What type of vulnerability is CVE-2026-14904?
CVE-2026-14904 is an arbitrary file read vulnerability due to improper link resolution before file access.
What is affected by CVE-2026-14904?
CVE-2026-14904 affects the Auth.GetUserPrivateKey API in AWS Research and Engineering Studio (RES).
Who is impacted by CVE-2026-14904?
Authenticated remote users of AWS Research and Engineering Studio (RES) are impacted by CVE-2026-14904.