CVE-2026-126087

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126087
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126087.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126087
Published
2026-11-10T18:49:55Z
Modified
2026-11-14T02:30:23Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L CVSS Calculator
Summary
Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent
Details

Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable.

To remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-426"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126087.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0.11.0"
                        },
                        {
                            "fixed": "0.33.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0.11.0"
                        },
                        {
                            "fixed": "0.33.0"
                        }
                    ],
                    "source": "CPE_FIELD",
                    "strategy": "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0.11.0"
                        },
                        {
                            "fixed": "0.33.0"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git
github.com/aws-deadline/deadline-cloud-worker-agent

Affected ranges

Type
GIT
Repo
https://github.com/aws-deadline/deadline-cloud-worker-agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2f84698b6e785d6b0946efea9958783096b12730
Database specific
Show details 
{
    "extracted_events": [
        {
            "original_tag": "0.33.0",
            "range": [
                {
                    "fixed": "2f84698b6e785d6b0946efea9958783096b12730"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.12.0
0.12.1
0.13.0
0.14.0
0.14.1
0.15.0
0.15.1
0.16.0
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.18.0
0.19.0
0.20.0
0.20.1
0.21.0
0.21.1
0.21.2
0.22.0
0.22.1
0.23.0
0.23.1
0.24.0
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.27.5
0.28.0
0.28.1
0.28.10
0.28.11
0.28.12
0.28.13
0.28.14
0.28.15
0.28.16
0.28.17
0.28.18
0.28.19
0.28.2
0.28.20
0.28.21
0.28.3
0.28.4
0.28.5
0.28.6
0.28.7
0.28.8
0.28.9
0.29.0
0.29.1
0.29.2
0.30.0
0.30.1
0.30.2
0.31.0
0.31.1
0.32.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126087.json"
github.com/openjobdescription/openjd-sessions-for-python

Affected ranges

Type
GIT
Repo
https://github.com/openjobdescription/openjd-sessions-for-python
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
396b3c1a7eb17b3170118d31c16e9e2fdbdf542e
Database specific
Show details 
{
    "extracted_events": [
        {
            "original_tag": "0.11.0",
            "range": [
                {
                    "fixed": "396b3c1a7eb17b3170118d31c16e9e2fdbdf542e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126087.json"