CVE-2026-124848 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Kiro CLI, an AI coding assistant for the terminal, wrote session transcripts and prompt history with permissions that let other local users on the same host read them. A local user can read prompts, model responses, tool output, and any credentials or source code in them.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Kiro CLI versions from 1.16.0 before 2.27.0 on macOS and Linux are affected, including forks or derivatives of its code. Exposure requires another user account on the same machine, so single-user laptops and machines with no shared local users are lower risk. Anyone who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also check the bash history file.
Not affected if kiro-cli-2.27.0-or-later, single-user-machine, windows
Who cares amazon-q-developer-cli, aws, kiro-cli, lab-disclosure, linux, macos, shared-hosts
kiro-cli --version (exact command unknown; the sources do not confirm the binary name); affected if below 2.27.0.~/.kiro and, for Amazon Q Developer CLI 1.16.0 through 1.19.x, on ~/.aws/amazonq/.cli_bash_history; other local users should not be able to read them.2.27.0 or later.CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI
Bulletin ID: 2026-178-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 12:45 PM PST
Description:
Kiro CLI is an AI coding assistant that runs in the terminal.
We identified CVE-2026-124848, an issue in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux. Kiro CLI created its session transcript and prompt history files with permissions that allowed other local users on the same host to read them. Another local user might read a user's prompts, model responses and tool output, including any credentials or source code they contain.
Impacted versions: Kiro CLI >= 1.16.0 AND < 2.27.0
Resolution:
This issue has been addressed in Kiro CLI version 2.27.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users should launch the upgraded Kiro CLI once so existing session files are restricted to the owner. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.
Workarounds:
Users who cannot upgrade immediately can restrict access to the owner by running "chmod -R go-rwx ~/.kiro" on macOS and Linux, and by running "umask 077" in the shell before launching Kiro CLI so that new files are created owner-only. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also run "chmod go-rwx ~/.aws/amazonq/.cli_bash_history".
References:
Please email aws-security@amazon.com with any s ecurity questions or concerns.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.16.01.19.x~/.aws/amazonq/.cli_bash_historyThis page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.