AmazonAnalysisAWS patches relative path traversal flaw in ParallelCluster CLI
What happened.Amazon Web Services published security bulletin 2026-174-AWS resolving a relative path traversal vulnerability in the AWS ParallelCluster command-line interface.
Why it matters.AWS ParallelCluster deploys high-performance computing clusters for scientific simulation and engineering research. When log extraction commands permit arbitrary file writes, compromised S3 buckets allow attackers to overwrite local scripts and binaries on administrator workstations. DevOps engineers running ParallelCluster should update the CLI package to version 3.16.0 immediately. Cloud teams should audit write permissions on cluster log export buckets.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-124033 with a 7.5 CVSS score, the flaw resides in the log export routines of the CLI.
- Affected commands: The defect affects the export-cluster-logs and export-image-logs subcommands in aws-parallelcluster versions 3.0.0 through 3.15.0.
- Exploitation mechanics: Remote attackers with write access to the target Amazon S3 bucket craft object keys containing directory traversal sequences.
- Filesystem risk: Unpacking the logs writes arbitrary files outside the target directory with the local privileges of the CLI operator.
- Remediation release: AWS released ParallelCluster CLI version 3.16.0, adding path sanitization to reject S3 object keys with traversal patterns.