CVE-2026-14904
RES Auth.GetUserPrivateKey Arbitrary File Read
AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.
| CWE | CWE-59 |
| Vendor | aws |
| Product | res |
| Published | Jul 7, 2026 |
| Last Updated | Jul 7, 2026 |
Get instant alerts for aws res
Be the first to know when new medium vulnerabilities affecting aws res are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N