CVE-2026-11931

Insecure Permissions on Authentication Token Cache File in Kiro IDE

State: Published
Severity: 6.8 Medium
Published: Jun 15, 2026
Updated: Jun 15, 2026
Reserved: Jun 10, 2026

Description

Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).

To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	AMZN
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	AMZN

Weaknesses

CWE-276 Incorrect default permissions

Affected Products

Product	Versions
Kiro IDEAWS	before 0.11.133Affected

References

https://kiro.dev/changelog/ide/0-11/#patch-0-11-133release-notes
https://aws.amazon.com/security/security-bulletins/2026-045-aws/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.