AWS Deadline Cloud Worker Update Fixes Job-to-Worker Privilege Exposure
Tech GuruQuick Answer
Update customer-managed Linux workers to agent 0.33.0 or later with OpenJD Sessions 0.11.0. Restrict job submission until upgraded and review CloudTrail for unexpected fleet-role and queue-role activity.
Confirm Scope And Apply The Supported Remediation
What to do now: Record fleet type, host OS, installed worker and OpenJD versions, queue principals and attached roles. Confirm customer-managed Linux use and who can submit jobs. Do not extend the issue to Windows workers or already-remediated service-managed fleets. Upgrade workers and maintained forks. AWS states there is no configuration fix; temporarily restrict deadline:CreateJob to trusted principals until the update is complete. Restart workers through the supported procedure, verify loaded versions, run representative trusted jobs, and review fleet and queue role activity in CloudTrail.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OpenJD Sessions for Python and AWS Deadline Cloud customer-managed Linux workers |
|---|---|
| Advisory | 2026-177-AWS / GHSA-g25v-j45m-7425 |
| CVE | CVE-2026-126087 |
| Authoritative release date | November 10, 2026 at 10:45 PST (18:45 UTC), from AWS bulletin 2026-177-AWS. |
| Authority revision date | November 10, 2026 at 13:30 PST (21:30 UTC), as stated by AWS. |
| Affected versions | OpenJD Sessions for Python before 0.11.0 and Deadline Cloud worker agent before 0.33.0 on Linux. A submitter needs permission to create jobs in an affected queue. Service-managed fleets were remediated by AWS; Windows workers are not affected. |
| Fixed version | OpenJD Sessions 0.11.0; Deadline Cloud worker agent 0.33.0 or later |
| CVSS base score | 8.8 (project CVSS v3.1 base score) |
| CVSS severity | High |
| Exploitation status | AWS does not state malicious exploitation in these advisories.; no exploitation claim is inferred. |
What Changed
A job-controlled PATH could cause the Linux worker to launch an untrusted command as the worker agent user, exposing worker credentials and, on customer-managed hosts, other queues’ session data and credentials.
What To Validate Now
- Inventory. Record fleet type, host OS, installed worker and OpenJD versions, queue principals and attached roles.
- Establish applicability. Confirm customer-managed Linux use and who can submit jobs. Do not extend the issue to Windows workers or already-remediated service-managed fleets.
- Remediate. Upgrade workers and maintained forks. AWS states there is no configuration fix; temporarily restrict deadline:CreateJob to trusted principals until the update is complete.
- Validate. Restart workers through the supported procedure, verify loaded versions, run representative trusted jobs, and review fleet and queue role activity in CloudTrail.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve job, host and cloud audit records before replacing workers. Coordinate in-flight rendering jobs and investigate potentially exposed credentials through the incident-response process.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
