CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI
CVE-2026-124848
Summary
Bulletin ID: 2026-177-AWS
Publication Date: 11/10/2026 10:45 AM PST
Description:
Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable.
Impacted versions:
- openjd-sessions < 0.11.0
- deadline-cloud-worker-agent < 0.33.0
Refer to the article for the most up-to-date and complete information.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.