CVE-2026-14904: AWS RES Information Disclosure Flaw

CVE-2026-14904 Overview

CVE-2026-14904 is an improper link resolution before file access vulnerability [CWE-59] in AWS Research and Engineering Studio (RES). RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. The flaw resides in the Auth.GetUserPrivateKey API on the cluster-manager EC2 instance. An authenticated remote user can replace the SSH private key file ~/.ssh/id_rsa with a symbolic link targeting any file on the host. The cluster-manager process runs as root, so any file readable by root becomes exposed through the API. AWS recommends upgrading to RES version 2026.06.

Critical Impact
Authenticated remote users can read arbitrary files on the cluster-manager EC2 instance, including other users' SSH private keys and application configuration secrets.

Affected Products

AWS Research and Engineering Studio (RES) versions prior to 2026.06
RES cluster-manager EC2 instance component
Deployments exposing the Auth.GetUserPrivateKey API

Discovery Timeline

2026-07-07 - CVE-2026-14904 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14904

Vulnerability Analysis

The vulnerability affects the Auth.GetUserPrivateKey API exposed by the RES cluster-manager. The API reads a user's SSH private key from ~/.ssh/id_rsa and returns the content to the caller. The implementation does not validate whether the target path is a regular file or a symbolic link before reading.

An authenticated user with shell access to their home directory can replace ~/.ssh/id_rsa with a symlink pointing to any file on the host. When the API subsequently reads the file, it follows the link and returns the contents of the target. Because the cluster-manager service runs as root, the read succeeds against any file the root user can access.

Exposed data includes other users' SSH private keys stored under /home/*/.ssh/, application configuration files containing database credentials, API tokens, and cluster secrets. This provides a path from a low-privilege authenticated account to lateral movement across the RES environment.

Root Cause

The root cause is the absence of link resolution checks before file access [CWE-59]. The API trusts that the path ~/.ssh/id_rsa resolves to a regular file owned by the caller. It does not use safe file-opening semantics such as O_NOFOLLOW or verify file ownership and type before reading.

Attack Vector

The attacker authenticates to RES with valid low-privilege credentials. They log in to their virtual desktop or otherwise obtain write access to their own home directory. The attacker removes the existing id_rsa file and creates a symlink pointing to a sensitive target such as /root/.ssh/id_rsa, /etc/shadow, or a RES configuration file. They then invoke the Auth.GetUserPrivateKey API. The cluster-manager reads the symlink target as root and returns the file contents in the API response.

No user interaction from a victim is required. The attack is network-reachable through the standard RES authenticated API surface.

Detection Methods for CVE-2026-14904

Indicators of Compromise

Symbolic links present at ~/.ssh/id_rsa paths within user home directories on the cluster-manager instance
Unexpected file read events by the cluster-manager process targeting files outside user home directories
Auth.GetUserPrivateKey API responses containing content that does not match SSH private key format
Access log entries showing repeated calls to Auth.GetUserPrivateKey from a single authenticated user

Detection Strategies

Audit user home directories for id_rsa files that are symbolic links rather than regular files using find /home -name id_rsa -type l
Monitor filesystem access by the cluster-manager service for reads outside expected paths using auditd rules on Linux
Correlate RES API access logs with unusual Auth.GetUserPrivateKey invocation patterns per user

Monitoring Recommendations

Enable auditd file access monitoring on /root/, /etc/shadow, and RES configuration directories
Ship cluster-manager application logs and Linux audit logs to a centralized SIEM for correlation
Alert on any process running as root that opens files following a symlink originating from a user-writable directory

How to Mitigate CVE-2026-14904

Immediate Actions Required

Upgrade AWS Research and Engineering Studio to version 2026.06 or later as recommended by AWS
Rotate all SSH private keys, database credentials, and API tokens that may have been exposed on the cluster-manager instance
Review RES API access logs for prior invocations of Auth.GetUserPrivateKey and investigate anomalies
Restrict authenticated user access to only trusted researchers until the patch is applied

Patch Information

AWS released RES version 2026.06 to remediate this issue. Refer to the AWS Security Bulletin 2026-053 and the GitHub Release 2026.06 for upgrade instructions and release notes.

Workarounds

Scan and remove any symbolic links found at ~/.ssh/id_rsa paths across user home directories on the cluster-manager instance
Reduce the privileges of the cluster-manager process where possible to limit the scope of readable files
Temporarily disable or gate the Auth.GetUserPrivateKey endpoint if upgrading immediately is not feasible

bash

# Configuration example: identify symlinked id_rsa files on the cluster-manager host
sudo find /home -maxdepth 4 -name id_rsa -type l -printf '%p -> %l\n'

# Remove offending symlinks after investigation
# sudo rm /home/<user>/.ssh/id_rsa