CVE-2026-124848

Vendor

Amazon

Product

Kiro CLI

CVSS v3.1

5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness

CWE-276

Exposure class

Operating system

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 40
   AWS bulletin AWS 3h ago

   CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI

   Bulletin ID: 2026-178-AWS Publication Date: 11/10/2026 12:00 PM PST Description: Incorrect default file permissions in Kiro CLI before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a…

   CVE-2026-124848 Amazon Web Services Apple
2. 29
   CVE NVD 2h ago

   Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local…

   Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history…

   CVSS 5.5 CVE-2026-124848 Amazon