CVE-2026-48790

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

State: Published
Severity: 5.5 Medium
Published: Aug 11, 2026
Updated: Aug 12, 2026
Reserved: May 22, 2026

Description

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-276 Incorrect Default Permissions
CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
turso-clitursodatabase	< 1.0.26Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.