6.8
Medium
CVE-2026-11931 Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication…
Description
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kiro IDE 0.11 | earliest → < 0.11.133 | 0.11.133 |
References
- kiro.dev kiro.dev
- aws.amazon.com aws.amazon.com
Timeline
- Published
- Last modified
Other CVEs of Kiro IDE
The 6 CVEs of Kiro IDE →
CVE-2026-89332
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version…
5.5
Medium
CVE-2026-10591
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow…
8.8
High
CVE-2026-5429
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a…
7.8
High
CVE-2026-4295
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote…
7.8
High