{"id":"CVE-2026-107332","kind":"vulnerability","aliases":["CVE-2026-107332"],"related":[],"title":"AWS Toolkit for VS Code: world-readable CodeCatalyst bearer token cache on disk","description":"CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code\n\n### CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code\n\nBulletin ID: 2026-129-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 10:30 AM PDT\n\nDescription:\n\nAWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-107332, an issue in the CodeCatalyst connection handler. When a user connected to a CodeCatalyst Dev Environment, the extension cached the user's CodeCatalyst bearer token to a file with world-readable permissions and did not remove the file after the session ended. A local user or process on the same machine with access to the file system was able to read this file and obtain the bearer token.\n\nImpacted versions: < 4.10.0\n\nResolution:\n\nThis issue has been addressed in AWS Toolkit for Visual Studio Code version 4.10.0, released on July 9, 2026. Version 4.10.0 writes the token cache file with owner-only permissions and deletes it when the Dev Environment is stopped. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUsers who cannot upgrade immediately can delete any files named codecatalyst..token in the AWS Toolkit extension's Visual Studio Code global storage directory after each session.\n\nReferences:\n\n- CVE-2026-107332\n- GHSA-9g5j-qgqm-857j\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Before 4.10.0, the AWS Toolkit for Visual Studio Code extension cached a user's CodeCatalyst bearer token in a world-readable file and did not delete it after a Dev Environment session ended. A local user or process on the same machine can read that file and take the token.","severity":"medium","cvss":6.8,"epss":0.00106,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","codecatalyst","developer-workstation","lab-disclosure","package","vs-code"],"not_affected_if":["extension-4.10.0-or-later","no-codecatalyst-usage","single-user-machine"],"how_to_check":"- Look for files named `codecatalyst..token` in the AWS Toolkit extension's Visual Studio Code global storage directory.\n- Check the installed extension version in VS Code; versions below `4.10.0` are affected.","fix":"- Upgrade the AWS Toolkit for Visual Studio Code extension to `4.10.0` or later.\n- Until upgraded, delete any `codecatalyst..token` files in the extension's global storage directory after each session.\n- Rotate the CodeCatalyst bearer token if a cached file may have been readable by others.","status":"open","published_at":"2026-10-08T18:17:19+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T03:45:20+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T03:45:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the AWS Toolkit for Visual Studio Code extension to `4.10.0` or later.\n- Until upgraded, delete any `codecatalyst..token` files in the extension's global storage directory after each session.\n- Rotate the CodeCatalyst bearer token if a cached file may have been readable by others.","reach":"local","title":"AWS Toolkit for VS Code: world-readable CodeCatalyst bearer token cache on disk","impact":"medium","summary":"Before 4.10.0, the AWS Toolkit for Visual Studio Code extension cached a user's CodeCatalyst bearer token in a world-readable file and did not delete it after a Dev Environment session ended. A local user or process on the same machine can read that file and take the token.","category":"package","nicknames":[],"who_cares":["aws","vs-code","codecatalyst","developer-workstation"],"confidence":0.85,"needs_auth":"no","worst_case":"Local users can read and reuse the CodeCatalyst bearer token.","analyst_note":"","how_to_check":"- Look for files named `codecatalyst..token` in the AWS Toolkit extension's Visual Studio Code global storage directory.\n- Check the installed extension version in VS Code; versions below `4.10.0` are affected.","needs_analyst":false,"not_affected_if":["extension-4.10.0-or-later","no-codecatalyst-usage","single-user-machine"],"who_is_affected":"Developers who connected VS Code to a CodeCatalyst Dev Environment with the AWS Toolkit extension before 4.10.0 on a shared or multi-user machine are exposed, because other local users or processes could read the cached token. Machines with a single trusted user, or that never used CodeCatalyst Dev Environments, have less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":3940,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107332':17A,20A,86C,103C,168C,334C '-129':121C '-2026':16A,19A,85C,102C,167C,333C '10':133C '10/08/2026':132C '2026':120C,260C '30':134C '4.10.0':34B,240C,255C,262C '857j':339C '9':259C '9g5j':337C 'abl':228C 'access':222C 'address':246C 'amazon':157C 'attent':129C 'aw':1A,21B,36B,95C,112C,122C,124C,138C,154C,248C,318C 'aws-security@amazon.com':342C 'bearer':10A,48B,192C,236C 'bulletin':118C 'cach':12A,43B,92C,109C,187C,266C 'cannot':306C 'code':5A,32B,41B,100C,117C,143C,163C,253C,295C,324C 'codecatalyst':9A,22B,47B,158C,173C,182C,191C,314C 'concern':348C 'connect':174C,179C 'content':125C 'credenti':93C,110C 'cve':15A,18A,84C,101C,166C,332C 'date':131C 'default':88C,105C 'delet':59B,274C,310C 'deriv':294C 'descript':137C 'dev':63B,183C,278C 'develop':24B,151C 'developer-workst':23B 'directori':327C 'disclosur':28B 'disk':14A 'email':341C 'end':66B,211C 'ensur':290C 'environ':64B,184C,279C 'extens':42B,148C,186C,320C 'file':55B,79B,89C,106C,196C,207C,225C,232C,267C,312C 'fix':302C 'fork':292C 'ghsa':336C 'ghsa-9g5j-qgqm-857j':335C 'global':325C 'handler':175C 'id':119C 'identifi':165C 'immedi':308C 'impact':238C 'import':127C 'includ':156C 'incorpor':299C 'insecur':87C,104C 'issu':170C,243C 'juli':258C 'lab':27B 'lab-disclosur':26B 'latest':287C 'let':150C 'local':68B,213C 'machin':75B,220C 'name':313C 'new':301C 'obtain':234C 'open':146C 'owner':270C 'owner-on':269C 'packag':29B 'patch':297C 'pdt':136C 'permiss':90C,107C,201C,272C 'pleas':340C 'process':71B,216C 'public':130C 'qgqm':338C 'question':346C 'read':77B,230C 'readabl':8A,54B,200C 'recommend':283C 'refer':331C 'releas':256C 'remov':205C 'requir':128C 'resolut':241C 'scope':123C 'secur':345C 'servic':155C 'session':65B,210C,330C 'sourc':147C 'stop':281C 'storag':326C 'studio':40B,99C,116C,142C,162C,252C,323C 'system':226C 'take':81B 'token':11A,49B,83B,193C,237C,265C,315C 'toolkit':2A,37B,96C,113C,139C,249C,319C 'type':126C 'upgrad':284C,307C 'user':45B,69B,178C,189C,214C,304C 'version':239C,254C,261C,288C 'visual':39B,98C,115C,141C,161C,251C,322C 'vs':4A,31B 'vs-code':30B 'within':160C 'work':152C 'workaround':303C 'workstat':25B 'world':7A,53B,199C 'world-read':6A,52B,198C 'write':263C","nicknames":[],"mitigations":[],"who_affected":"Developers who connected VS Code to a CodeCatalyst Dev Environment with the AWS Toolkit extension before 4.10.0 on a shared or multi-user machine are exposed, because other local users or processes could read the cached token. Machines with a single trusted user, or that never used CodeCatalyst Dev Environments, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T18:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-129-aws/#CVE-2026-107332","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-129-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code"},{"source":"nvd","external_id":"CVE-2026-107332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107332","severity":null,"published_at":"2026-10-08T18:17:19+00:00","modified_at":"2026-10-09T17:16:45+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107332","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107332","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2884,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-129-aws/","title":"AWS: CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code","kind":"advisory","source":"lab","text":"CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code\n\n### CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code\n\nBulletin ID: 2026-129-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 10:30 AM PDT\n\nDescription:\n\nAWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-107332, an issue in the CodeCatalyst connection handler. When a user connected to a CodeCatalyst Dev Environment, the extension cached the user's CodeCatalyst bearer token to a file with world-readable permissions and did not remove the file after the session ended. A local user or process on the same machine with access to the file system was able to read this file and obtain the bearer token.\n\nImpacted versions: < 4.10.0\n\nResolution:\n\nThis issue has been addressed in AWS Toolkit for Visual Studio Code version 4.10.0, released on July 9, 2026. Version 4.10.0 writes the token cache file with owner-only permissions and deletes it when the Dev Environment is stopped. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUsers who cannot upgrade immediately can delete any files named codecatalyst..token in the AWS Toolkit extension's Visual Studio Code global storage directory after each session.\n\nReferences:\n\n- CVE-2026-107332\n- GHSA-9g5j-qgqm-857j\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}