CVE-2026-126087

Name of the Vulnerable Software and Affected Versions Open Job Description (OpenJD) Sessions for Python versions prior to 0.11.0 AWS Deadline Cloud worker agent versions prior to 0.33.0

Description An untrusted search path in the cross-user process launcher on Linux allows an authenticated remote user with job submission permissions to execute arbitrary code as the worker agent OS user. This can be achieved via a crafted job that modifies the PATH environment variable, potentially enabling the attacker to obtain AWS credentials held by the worker agent.

Recommendations Upgrade Open Job Description (OpenJD) Sessions for Python to version 0.11.0 or later. Upgrade AWS Deadline Cloud worker agent to version 0.33.0 or later.