AmazonAnalysisAWS patches untrusted search path flaw in OpenJD Sessions and Deadline Cloud worker
What happened.Amazon Web Services released security updates fixing an untrusted search path vulnerability in the OpenJD Sessions runtime and AWS Deadline Cloud worker agent.
Why it matters.Cloud render farms process complex computational tasks across multi-user environments. When task runners load executable code from untrusted working directories, malicious users elevate privileges and access shared worker assets. Pipeline technical directors must update OpenJD Sessions and Deadline Cloud worker agents to the latest releases across all compute nodes.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-126087 in bulletin 2026-177-AWS, the flaw involves insecure Python binary search resolution during job execution.
- Exploitation path: Local users with filesystem write access place malicious executable files inside working directories processed by the worker agent.
- Privilege escalation: When the worker agent launches render tasks, the runtime executes attacker-supplied binaries under elevated worker system privileges.
- Remediation release: AWS published updated package versions to package repositories and advised administrators to update worker fleets immediately.