Which GluonTS versions are affected by CVE-2026-119083?

GluonTS releases before 0.17.0 are affected, according to AWS bulletin 2026-171-AWS. Version 0.17.0 carries the fix and is the current release on PyPI, published on July 31, 2026. Teams that pin an older GluonTS in a requirements file or a container image stay exposed until they move to 0.17.0 or later, on any operating system.

How would an attacker exploit the GluonTS archive extraction flaw?

Exploitation requires GluonTS to extract a tar archive the attacker controls. AWS says a crafted archive holding symbolic or hard links can write files outside the intended extraction directory, with the privileges of the extracting process. Pipelines that unpack only archives they build themselves, or that come from trusted internal storage, are not reachable through this path.

What can defenders do if upgrading GluonTS is not possible yet?

AWS recommends not using GluonTS to extract tar archives from untrusted or unverified sources until the upgrade lands. AWS also points to Python 3.14 or later, where TarFile.extractall applies the data extraction filter by default and blocks this link-based traversal as defense in depth. Any forked or derivative copies of the extraction code need the same fix.

MEDVulnerability

GluonTS: a tar archive's links write files outside the target directory

A crafted tar archive can make GluonTS write files anywhere the extracting process can reach, fixed in version 0.17.0.

November 5, 2026 · Amazon Web Services · Research by Udit Jain

CVE-2026-119083

MEDVulnerability

GluonTS before 0.17.0 lets a crafted tar archive write files outside the extraction directory through symbolic or hard links, running with the extracting process's privileges. AWS disclosed it on November 5 and credits Udit Jain.

01What happened

Amazon Web Services published security bulletin 2026-171-AWS on November 5, 2026, assigning CVE-2026-119083 to an arbitrary file write in GluonTS, its open-source Python library for probabilistic time series modeling. Udit Jain reported the flaw to AWS through coordinated vulnerability disclosure. AWS labels the bulletin Important, its category for issues that require attention.

02How it works

The flaw sits in the library's archive extraction utility. A tar archive that carries symbolic or hard links can point those links outside the directory GluonTS unpacks into, so extraction writes to paths the archive chooses rather than paths the caller intended. Each write carries the privileges of the process doing the extraction.

03Who is affected

Every GluonTS release before 0.17.0 is affected. Real exposure depends on whether a pipeline extracts tar archives that someone outside the team can supply or modify. Forks and derivative code that copied the extraction utility carry the same flaw.

04What to do

Upgrade to GluonTS 0.17.0 or later, which is the current release on PyPI. Until that lands, do not point GluonTS at tar archives from untrusted or unverified sources, and apply the same fix to any forked copies of the extraction code.

Questions people ask

Which GluonTS versions are affected by CVE-2026-119083?: GluonTS releases before 0.17.0 are affected, according to AWS bulletin 2026-171-AWS. Version 0.17.0 carries the fix and is the current release on PyPI, published on July 31, 2026. Teams that pin an older GluonTS in a requirements file or a container image stay exposed until they move to 0.17.0 or later, on any operating system.
How would an attacker exploit the GluonTS archive extraction flaw?: Exploitation requires GluonTS to extract a tar archive the attacker controls. AWS says a crafted archive holding symbolic or hard links can write files outside the intended extraction directory, with the privileges of the extracting process. Pipelines that unpack only archives they build themselves, or that come from trusted internal storage, are not reachable through this path.
What can defenders do if upgrading GluonTS is not possible yet?: AWS recommends not using GluonTS to extract tar archives from untrusted or unverified sources until the upgrade lands. AWS also points to Python 3.14 or later, where TarFile.extractall applies the data extraction filter by default and blocks this link-based traversal as defense in depth. Any forked or derivative copies of the extraction code need the same fix.

01What happened

02How it works

03Who is affected

04What to do

Questions people ask

Sources 3 links, all fetched

Related