AmazonAnalysisAWS addresses relative path traversal flaw in ParallelCluster CLI log exports
What happened.Amazon Web Services published a security bulletin resolving a relative path traversal vulnerability affecting cluster log export commands in the AWS ParallelCluster command-line tool.
Why it matters.High-performance computing clusters rely on ParallelCluster to orchestrate massive distributed computational workloads across cloud resources. When command-line tooling allows directory traversal file writes, attackers tamper with orchestration scripts and elevate privileges. Cloud operations teams must upgrade local ParallelCluster installations to version 3.13.0 immediately.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-124033 in bulletin 2026-174-AWS, the flaw stems from insufficient input sanitization during export-cluster-logs operations.
- Exploitation path: An attacker with cluster access provides manipulated directory parameters to write exported log archives outside intended storage directories.
- Arbitrary file write: The directory escape permits unauthorized file creation or overwrites on the local administrative machine executing orchestration commands.
- Remediation release: AWS published ParallelCluster version 3.13.0 with strict file path validation routines to block unauthorized path traversal attempts.