---
id: "GHSA-h79v-mp93-644r"
page: "https://infrastack.ai/live/GHSA-h79v-mp93-644r"
kind: "vulnerability"
aliases: ["GHSA-h79v-mp93-644r"]
title: "CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "aws-parallelcluster", "hpc", "lab-disclosure", "package", "python"]
not_affected_if: ["bucket-restricted-to-trusted-users", "no-log-export-usage", "version-3.16.0-or-later"]
published_at: null
first_seen_at: "2026-11-09T23:46:36+00:00"
updated_at: "2026-11-09T23:48:03+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-174-aws/", "first_seen_at": "2026-11-09T23:46:36+00:00"}]
exploit_sources: []
---

# CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI

Link for people: https://infrastack.ai/live/GHSA-h79v-mp93-644r (this .md is for agents)

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before 3.16.0 allow a relative path traversal via a crafted S3 object key. An attacker with write access to the log export bucket can write files outside the intended directory, with names and content they control, using the privileges of the user running the command.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pcluster version` or `pip show aws-parallelcluster`; versions below `3.16.0` (and from `3.0.0`) are affected.
- Check whether the log export S3 bucket is writable by anyone beyond trusted users.

## Fix

- aws-parallelcluster `3.16.0`
- Forked or derivative code should also be patched with the new fixes, per the vendor.

## Timeline

- 2026-11-09T23:46:36+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-174-aws/ — AWS: CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI

## Documents

- [mentions] AWS: CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI https://aws.amazon.com/security/security-bulletins/rss/2026-174-aws/

## From the sources

CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI

### CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI

Bulletin ID: 2026-174-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/09/2026 13:00 PM PST

 Description:

AWS ParallelCluster CLI is an open source command line tool, distributed on PyPI as aws-parallelcluster, that customers use to create and manage HPC clusters on AWS.

We identified CVE-2026-124033, an issue where the export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.

Impacted versions: >= 3.0.0 AND < 3.16.0

Resolution:

This issue has been addressed in aws-parallelcluster version 3.16.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes

Workarounds:

Ensure the Amazon S3 bucket used for log export is accessible by only trusted users.

References:

- CVE-2026-124033
- GHSA-h79v-mp93-644r

Acknowledgement:

We would like to thank Mohamed Abdelaal (0xmrma) for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_