CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI
Bulletin ID: 2026-178-AWS Publication Date: 11/10/2026 12:00 PM PST Description: Incorrect default file permissions in Kiro CLI before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. Impacted versions: Kiro CLI >= 1.16.0 AND Refer to the article for the most up-to-date and complete information.
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Apple
- Product
- macOS
- Exposure class
- Operating system
Why it ranks 40 (Notable)
- Product class: operating system
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-124848 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.