# CVE-2026-14904: AWS Research and Engineering Studio Arbitrary File Read in Auth.GetUserPrivateKey

Source: https://junglewise.ai/threats/cve-2026-14904-aws-research-and-engineering-studio-arbitrary-file-read-in-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14904 · Severity: high · CVSS 6.5 · Published 2026-07-07

AWS Research and Engineering Studio is a cloud-based platform for collaborative research and development. A vulnerability in its authentication system could allow attackers to improperly access private encryption keys used to secure user data and communications, potentially leading to unauthorized access to sensitive research data and customer information stored within the service.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [Amazon Web Services Research and Engineering Studio](https://junglewise.ai/threats/technologies/research-and-engineering-studio). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [Amazon Web Services](https://junglewise.ai/threats/vendors/amazon-web-services).

## Quick answers

**Is CVE-2026-14904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14904 being exploited in the wild.

**How severe is CVE-2026-14904?** High severity, with a CVSS score of 6.5, published 7 July 2026.

**Which products and versions are affected?** Amazon Web Services Research and Engineering Studio <= 2026.03.

**Is there a fix for CVE-2026-14904?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14904 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14904?** Check whether you run Amazon AWS, Amazon AWS Research and Engineering Studio or Amazon Web Services Research and Engineering Studio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper link resolution flaw in the Auth.GetUserPrivateKey function within AWS Research and Engineering Studio. The root cause involves insecure handling of symbolic links or path resolution that could allow an attacker to retrieve private authentication keys. This appears to be exploitable through network access to the affected authentication mechanism. An attacker could leverage this to obtain private keys, potentially bypassing authentication controls or gaining unauthorized access to encrypted data. AWS has published a security bulletin but patch details and availability are not fully specified in the provided content.

## Affected products

- Amazon Web Services AWS Research and Engineering Studio

## Timeline

- 2026-09-22: disclosed

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-053-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-053-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)