File Permission Vulnerability in Kiro CLI on macOS and Linux
CVE-2026-124848

6.8MEDIUM

Key Information:

Vendor

Amazon

Status
Kiro Cli
Vendor
CVE Published:
10 November 2026

Badges

💰 Ransomware👾 Exploit Exists📰 News Worthy

What is CVE-2026-124848?

Kiro CLI, formerly known as Amazon Q Developer CLI, has a vulnerability due to incorrect default file permissions in its session storage files on macOS and Linux. This flaw allows local users on the same machine to read sensitive session transcripts and command history, potentially exposing user credentials and source code. Users are urged to upgrade to version 2.27.0 or higher to mitigate this risk and are advised to delete or restrict access to sensitive history files.

Affected Version(s)

Kiro CLI 1.16.0 < 2.27.0

News Articles

favicon imageIt Security News

IT Security News Roundup: 2026-11-12 Overnight - IT Security News

IT Security News: Overnight roundup, 2026-11-12 Summary Between midnight and six CET, the stories clustered around software supply chains, AI infrastructure and credential exposure, with a strong thread of attackers exploiting trust: trusted vendor access, trusted tooling, and trusted hardware…Read ...

2 days ago

References

https://kiro.dev/changelog/cli/2-27/
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by It Security News

  • Vulnerability published

  • Vulnerability Reserved

.