AWS Research and Engineering Studio (RES) versions before 2026.06 contain a CWE-59 improper link resolution vulnerability in the Auth.GetUserPrivateKey API. This flaw allows an authenticated remote user to substitute their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the cluster-manager EC2 instance. Because the cluster-manager process runs with root privileges, this leads to unauthorized reading of arbitrary files accessible by root, exposing sensitive information such as other users' SSH private keys and application configuration secrets. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity). AWS provides a security bulletin with remediation details and manages patching for this cloud service.

An authenticated remote attacker can read arbitrary files on the cluster-manager EC2 instance running as root by exploiting symbolic link resolution in the vulnerable API. This exposure includes sensitive SSH private keys and application secrets, potentially compromising confidentiality and security of the system and other users. The vulnerability does not require user interaction and has network attack vector with low attack complexity.

AWS manages remediation for this vulnerability in their cloud-hosted Research and Engineering Studio (RES) service. A patch is available and should be applied as per the AWS Security Bulletin 2026-053-AWS (https://aws.amazon.com/security/security-bulletins/2026-053-aws/). Users should follow AWS guidance to ensure their RES instances are updated to versions 2026.06 or later. No additional mitigation actions are indicated by the vendor advisory.