AWS ParallelCluster 3.16.0 Fixes Log Export Path Traversal
Tech GuruQuick Answer
Update ParallelCluster CLI hosts and runners to 3.16.0 or later. Restrict writers to the log-export bucket, review unexpected local files after exports, and validate normal exports with the patched CLI.
Confirm Scope And Apply The Supported Remediation
What to do now: Record CLI versions, export commands, workstation and runner identities, destination directories and S3 write permissions. Confirm whether untrusted principals could write export objects and learn a task ID while a vulnerable CLI exported logs. Upgrade aws-parallelcluster to 3.16.0 or later and incorporate the fix into maintained forks. Limit export-bucket access to trusted principals. Confirm the active CLI package on each host, run a representative authorized export, review unexpected files outside the export directory and retain access-policy and package evidence.
Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS ParallelCluster CLI log export commands |
|---|---|
| Advisory | 2026-174-AWS / GHSA-h79v-mp93-644r |
| CVE | CVE-2026-124033 |
| Authoritative release date | November 9, 2026 at 13:00 PST (21:00 UTC), from AWS bulletin 2026-174-AWS. |
| Authority revision date | No later revision stated. |
| Affected versions | aws-parallelcluster 3.0.0 through versions before 3.16.0 when export-cluster-logs or export-image-logs consumes attacker-controlled S3 objects. The attacker requires write access to the export bucket and knowledge of the export task ID. |
| Fixed version | aws-parallelcluster 3.16.0 or later |
| CVSS base score | 6.4 (project CVSS v3.1 base score) |
| CVSS severity | Moderate (project severity) |
| Exploitation status | AWS does not state exploitation in the bulletin or project advisory.; no exploitation claim is inferred. |
What Changed
AWS fixed relative path traversal in the ParallelCluster log export commands. Crafted S3 object names can cause writes outside the intended directory, with the exporting user’s permissions; the project does not describe a file-read capability.
What To Validate Now
- Inventory. Record CLI versions, export commands, workstation and runner identities, destination directories and S3 write permissions.
- Establish applicability. Confirm whether untrusted principals could write export objects and learn a task ID while a vulnerable CLI exported logs.
- Remediate. Upgrade aws-parallelcluster to 3.16.0 or later and incorporate the fix into maintained forks. Limit export-bucket access to trusted principals.
- Validate. Confirm the active CLI package on each host, run a representative authorized export, review unexpected files outside the export directory and retain access-policy and package evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
A successful export does not prove earlier exports were safe. Preserve local artifacts and S3 audit history before cleanup; do not broaden bucket permissions to troubleshoot an update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
