Untrusted Search Path in Open Job Description Sessions for Python Impacting AWS Deadline Cloud Worker Agent

CVE-2026-126087

What is CVE-2026-126087?

An untrusted search path vulnerability exists in the cross-user process launcher within Open Job Description (OpenJD) Sessions for Python, specifically in versions prior to 0.11.0. This issue affects the AWS Deadline Cloud worker agent in versions before 0.33.0 on Linux systems. An authenticated remote user who is permitted to submit jobs to a queue could exploit this vulnerability to execute arbitrary code with the privileges of the worker agent OS user. This exploitation could lead to unauthorized access to sensitive AWS credentials held by the worker agent through a specially crafted job that modifies the PATH environment variable. To mitigate this risk, users are advised to upgrade to Deadline Cloud worker agent version 0.33.0 or later, which incorporates the necessary fixes.

References