GHSA-h79v-mp93-644r · Package
NO FIX YET · SEE WHAT TO DO
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before 3.16.0 allow a relative path traversal via a crafted S3 object key. An attacker with write access to the log export bucket can write files outside the intended directory, with names and content they control, using the privileges of the user running the command.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run the AWS ParallelCluster CLI (aws-parallelcluster on PyPI) below 3.16.0 and use the export-cluster-logs or export-image-logs commands. Exposure depends on who can write to the log export S3 bucket; if only trusted users can, the risk is reduced, as the vendor's workaround states.
Not affected if bucket-restricted-to-trusted-users, no-log-export-usage, version-3.16.0-or-later
Who cares aws, aws-parallelcluster, hpc, lab-disclosure, python
pcluster version or pip show aws-parallelcluster; versions below 3.16.0 (and from 3.0.0) are affected.3.16.0CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI
Bulletin ID: 2026-174-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/09/2026 13:00 PM PST
Description:
AWS ParallelCluster CLI is an open source command line tool, distributed on PyPI as aws-parallelcluster, that customers use to create and manage HPC clusters on AWS.
We identified CVE-2026-124033, an issue where the export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.
Impacted versions: >= 3.0.0 AND < 3.16.0
Resolution:
This issue has been addressed in aws-parallelcluster version 3.16.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes
Workarounds:
Ensure the Amazon S3 bucket used for log export is accessible by only trusted users.
References:
Acknowledgement:
We would like to thank Mohamed Abdelaal (0xmrma) for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.