GHSA-g25v-j45m-7425 · Package
NO FIX YET · SEE WHAT TO DO
On Linux, OpenJD Sessions for Python ran sudo by bare name, so a job could place its own sudo earlier in PATH and have it run as the worker agent user. That user holds AWS fleet and instance credentials, so an attacker with permission to submit jobs can take them.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Customer-managed AWS Deadline Cloud fleets running Linux workers with an affected worker agent or OpenJD Sessions version are exposed. Service-managed fleets were fixed by AWS, and Windows workers are not affected. Teams that only use service-managed fleets can skip it.
Not affected if service-managed-fleet, windows-workers
Who cares aws, deadline-cloud, lab-disclosure, linux, openjd-sessions, self-hosted
openjd-sessions version with pip show openjd-sessions and the worker agent version with deadline-cloud-worker-agent --version, if available.openjd-sessions 0.11.00.33.0 (includes OpenJD Sessions )CVE-2026-126087 - Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker agent
Bulletin ID: 2026-177-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 10:45 AM PST Last Updated Date: 11/10/2026 13:30 PM PST
Description:
AWS Deadline Cloud is a fully managed service for rendering and other compute-intensive workloads. The Deadline Cloud worker agent runs on fleet hosts. It uses Open Job Description (OpenJD) Sessions for Python, which is an open-source library, to run each job's actions as the queue's job user.
We identified CVE-2026-126087. On Linux, OpenJD Sessions switched to the job user by running sudo by its bare name, in an environment that the job controls. A job could add a directory to PATH and put its own executable named sudo there. That executable would then run as the worker agent OS user instead of the job user.
An authenticated user with permission to submit jobs to a queue could use this to run arbitrary code as the worker agent user. They could then obtain the AWS credentials that user holds, including fleet role credentials and EC2 instance identity credentials. On customer-managed fleets, they could also read or modify other queues' session data and queue role credentials on the same host.
Service-managed fleets were remediated service-side, and customers using them do not need to take any action. Customer-managed fleets running an affected worker agent version on Linux are affected. Windows workers are not affected.
Impacted versions:
Resolution:
This issue is fixed in OpenJD Sessions for Python version 0.11.0 and in AWS Deadline Cloud worker agent version 0.33.0, which includes OpenJD Sessions 0.11.0. OpenJD Sessions now finds sudo and its other system commands in a fixed list of trusted directories and never looks them up through PATH.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.11.0We recommend upgrading to the latest worker agent version and making sure any forked or derivative code includes the new fixes. Customers who ran affected versions on customer-managed fleets should review AWS CloudTrail for unexpected activity by their fleet role and queue roles.
Workarounds:
Upgrading is the only fix. No configuration setting removes the issue. Until a customer-managed fleet is upgraded, limit permission to submit jobs to its queues (deadline:CreateJob) to trusted principals.
References:
Please email aws-security@amazon.com with any s ecurity questions or concerns.