Incorrect Permissions in Kiro IDE Exposes Sensitive Cache Files on macOS and Linux

CVE-2026-11931

What is CVE-2026-11931?

The Kiro IDE application on macOS and Linux prior to version 0.11.133 has a vulnerability that entails incorrect default file permissions, allowing the authentication token cache to be accessible to other local users or processes. This results in the cache file being set to world-readable permissions (0644) instead of the more secure owner-restricted permissions (0600). Users are urged to upgrade to Kiro IDE version 0.11.133 or later to ensure that the cache file permissions are remedied during the next token refresh after the application restarts. In environments with multiple users, existing tokens may also be invalidated by reauthenticating.

References