Package vulnerability, severity medium
AWS ParallelCluster CLI log export path traversal (CVE-2026-124033) fixed in 3.16.0
Published
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI (PyPI package aws-parallelcluster) before 3.16.0 contain a relative path traversal flaw. An authenticated user with write access to the log export S3 bucket could use a crafted object key to write files outside the intended export directory on the machine running the command, with the privileges of the user running it. Fixed in version 3.16.0.
What's affected
- aws-parallelcluster (pypi)>=3.0.0 <3.16.0
What to do
- Upgrade aws-parallelcluster to version 3.16.0 or later.
- Ensure any forked or derivative code is patched to incorporate the fix.
- Restrict access to the S3 bucket used for log export to trusted users only.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident aws-parallelcluster-log-export-path-traversal-2026-11References
Notice aws-parallelcluster-log-export-path-traversal-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.