CVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit
Bulletin ID: 2026-096-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/03/2026 11:00 AM PDT
Description:
The AWS FPGA Developer Kit is a hardware-software development kit that enables developers to create accelerators for the high-performance accelerator cards on EC2 F2 instances. We identified CVE-2026-85028, where a creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges.
Impacted versions: < 2.3.4
Resolution:
This issue has been addressed in AWS FPGA Developer Kit version 2.3.4. The affected code that wrote the allow_non_root function to /tmp/sdk_root_env.exp has been removed and the SDK tools now source it directly from shared/bin/set_common_functions.sh. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Remove or comment out lines referencing /tmp/sdk_root_env.exp in sdk_setup.sh and install_fpga_mgmt_tools.sh.
References:
Acknowledgement:
We would like to thank George Chen for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.