{"id":"CVE-2026-124848","kind":"vulnerability","aliases":["CVE-2026-124848"],"related":[],"title":"Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and…","description":"CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI\n\n### CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI\n\nBulletin ID: 2026-178-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 12:45 PM PST\n\n Description:\n\nKiro CLI is an AI coding assistant that runs in the terminal.\n\nWe identified CVE-2026-124848, an issue in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux. Kiro CLI created its session transcript and prompt history files with permissions that allowed other local users on the same host to read them. Another local user might read a user's prompts, model responses and tool output, including any credentials or source code they contain.\n\nImpacted versions: Kiro CLI >= 1.16.0 AND < 2.27.0\n\nResolution:\n\nThis issue has been addressed in Kiro CLI version 2.27.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users should launch the upgraded Kiro CLI once so existing session files are restricted to the owner. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.\n\nWorkarounds:\n\nUsers who cannot upgrade immediately can restrict access to the owner by running \"chmod -R go-rwx ~/.kiro\" on macOS and Linux, and by running \"umask 077\" in the shell before launching Kiro CLI so that new files are created owner-only. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also run \"chmod go-rwx ~/.aws/amazonq/.cli_bash_history\".\n\nReferences:\n\n- CVE-2026-124848\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"Kiro CLI, an AI coding assistant for the terminal, wrote session transcripts and prompt history with permissions that let other local users on the same host read them. A local user can read prompts, model responses, tool output, and any credentials or source code in them.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","amazon-q-developer-cli","aws","kiro-cli","lab-disclosure","linux","macos","shared-hosts"],"not_affected_if":["kiro-cli-2.27.0-or-later","single-user-machine","windows"],"how_to_check":"- Check the Kiro CLI version with `kiro-cli --version` (exact command unknown; the sources do not confirm the binary name); affected if below `2.27.0`.\n- Look at permissions on `~/.kiro` and, for Amazon Q Developer CLI 1.16.0 through 1.19.x, on `~/.aws/amazonq/.cli_bash_history`; other local users should not be able to read them.","fix":"- Kiro CLI: upgrade to `2.27.0` or later.\n- Users who ran Amazon Q Developer CLI `1.16.0` through `1.19.x`: the sources also say to delete `~/.aws/amazonq/.cli_bash_history` or restrict it to the owner.","status":"open","published_at":"2026-11-10T20:19:07+00:00","first_seen_at":"2026-11-10T20:36:01+00:00","triaged_at":"2026-11-10T20:36:53+00:00","updated_at":"2026-11-10T20:46:04+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T20:36:53Z","model":"claude-haiku-5-5","output":{"fix":"- Kiro CLI: upgrade to `2.27.0` or later.\n- Users who ran Amazon Q Developer CLI `1.16.0` through `1.19.x`: the sources also say to delete `~/.aws/amazonq/.cli_bash_history` or restrict it to the owner.","reach":"local","title":"Kiro CLI: session transcripts and prompt history readable by other local users","impact":"medium","summary":"Kiro CLI, an AI coding assistant for the terminal, wrote session transcripts and prompt history with permissions that let other local users on the same host read them. A local user can read prompts, model responses, tool output, and any credentials or source code in them.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["kiro-cli","amazon-q-developer-cli","macos","linux","shared-hosts"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"other local users read prompts, responses and credentials","analyst_note":"","how_to_check":"- Check the Kiro CLI version with `kiro-cli --version` (exact command unknown; the sources do not confirm the binary name); affected if below `2.27.0`.\n- Look at permissions on `~/.kiro` and, for Amazon Q Developer CLI 1.16.0 through 1.19.x, on `~/.aws/amazonq/.cli_bash_history`; other local users should not be able to read them.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["kiro-cli-2.27.0-or-later","single-user-machine","windows"],"who_is_affected":"Kiro CLI versions from 1.16.0 before 2.27.0 on macOS and Linux are affected, including forks or derivatives of its code. Exposure requires another user account on the same machine, so single-user laptops and machines with no shared local users are lower risk. Anyone who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also check the bash history file.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000888,"input_tokens":5265,"output_tokens":724,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124848':20A,23A,90C,105C,154C,364C '-178':121C '-2026':19A,22A,89C,104C,153C,363C '/.aws/amazonq/.cli_bash_history':289C,360C '/.kiro':316C '077':325C '1.16.0':222C,281C,349C '1.19':283C,351C '11/10/2026':132C '12':133C '2.27.0':15A,167C,224C,235C '2026':120C '45':134C 'access':305C 'address':230C 'ai':25B,47B,142C 'ai-tool':24B 'allow':185C 'also':286C,354C 'amazon':9A,28B,161C,277C,345C 'amazon-q-developer-c':27B 'anoth':196C 'assist':49B,144C 'attent':129C 'aw':32B,122C,124C 'aws-security@amazon.com':367C 'bulletin':118C 'cannot':300C 'chmod':311C,356C 'cli':7A,12A,31B,35B,45B,102C,117C,139C,159C,164C,173C,221C,233C,263C,280C,332C,348C 'code':48B,87B,143C,215C,249C 'concern':374C 'contain':217C 'content':125C 'creat':174C,338C 'credenti':84B,212C 'cve':18A,21A,88C,103C,152C,362C 'date':131C 'default':2A,92C,107C 'delet':287C 'deriv':248C 'descript':137C 'develop':11A,30B,163C,279C,347C 'disclosur':38B 'ecur':371C 'email':366C 'ensur':244C 'exist':266C 'file':3A,181C,268C,290C,336C 'fix':256C 'fork':246C 'former':8A,160C 'go':314C,358C 'go-rwx':313C,357C 'histori':58B,99C,114C,180C 'host':43B,69B,192C 'id':119C 'identifi':151C 'immedi':302C 'impact':218C 'import':127C 'includ':210C 'incorpor':253C 'incorrect':1A,91C,106C 'issu':156C,227C 'kiro':6A,34B,44B,101C,116C,138C,158C,172C,220C,232C,262C,331C 'kiro-c':33B 'lab':37B 'lab-disclosur':36B 'latest':241C 'launch':259C,330C 'let':62B 'linux':39B,171C,320C 'local':64B,73B,187C,197C 'maco':17A,40B,169C,318C 'might':199C 'model':78B,205C 'new':255C,335C 'output':81B,209C 'owner':273C,296C,308C,340C 'owner-on':339C 'patch':251C 'permiss':4A,60B,93C,108C,183C 'pleas':365C 'pm':135C 'prompt':57B,77B,98C,113C,179C,204C 'pst':136C 'public':130C 'q':10A,29B,162C,278C,346C 'question':372C 'r':312C 'ran':276C,344C 'read':70B,76B,194C,200C 'recommend':237C 'refer':361C 'requir':128C 'resolut':225C 'respons':79B,206C 'restrict':270C,292C,304C 'run':146C,310C,323C,355C 'rwx':315C,359C 'scope':123C 'session':54B,95C,110C,176C,267C 'share':42B 'shared-host':41B 'shell':328C 'sourc':86B,214C 'termin':52B,149C 'tool':26B,80B,208C 'transcript':55B,96C,111C,177C 'type':126C 'umask':324C 'upgrad':238C,261C,301C 'user':65B,74B,188C,198C,202C,257C,274C,298C,342C 'version':14A,166C,219C,234C,242C 'workaround':297C 'wrote':53B 'x':284C,352C","nicknames":[],"mitigations":[],"who_affected":"Kiro CLI versions from 1.16.0 before 2.27.0 on macOS and Linux are affected, including forks or derivatives of its code. Exposure requires another user account on the same machine, so single-user laptops and machines with no shared local users are lower risk. Anyone who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also check the bash history file.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","amazonqdevelopercli","aws","kirocli","labdisclosure","linux","macos","medium","sharedhosts"],"campaign_type":null,"search_a":"'-124848':20A,23A '-2026':19A,22A '2.27.0':15A 'amazon':9A 'cli':7A,12A 'cve':18A,21A 'default':2A 'develop':11A 'file':3A 'former':8A 'incorrect':1A 'kiro':6A 'maco':17A 'permiss':4A 'q':10A 'version':14A","search_b":"'ai':25B,47B 'ai-tool':24B 'amazon':28B 'amazon-q-developer-c':27B 'assist':49B 'aw':32B 'cli':31B,35B,45B 'code':48B,87B 'credenti':84B 'develop':30B 'disclosur':38B 'histori':58B 'host':43B,69B 'kiro':34B,44B 'kiro-c':33B 'lab':37B 'lab-disclosur':36B 'let':62B 'linux':39B 'local':64B,73B 'maco':40B 'model':78B 'output':81B 'permiss':60B 'prompt':57B,77B 'q':29B 'read':70B,76B 'respons':79B 'session':54B 'share':42B 'shared-host':41B 'sourc':86B 'termin':52B 'tool':26B,80B 'transcript':55B 'user':65B,74B 'wrote':53B","search_c":"'-124848':90C,105C,154C,364C '-178':121C '-2026':89C,104C,153C,363C '/.aws/amazonq/.cli_bash_history':289C,360C '/.kiro':316C '077':325C '1.16.0':222C,281C,349C '1.19':283C,351C '11/10/2026':132C '12':133C '2.27.0':167C,224C,235C '2026':120C '45':134C 'access':305C 'address':230C 'ai':142C 'allow':185C 'also':286C,354C 'amazon':161C,277C,345C 'anoth':196C 'assist':144C 'attent':129C 'aw':122C,124C 'aws-security@amazon.com':367C 'bulletin':118C 'cannot':300C 'chmod':311C,356C 'cli':102C,117C,139C,159C,164C,173C,221C,233C,263C,280C,332C,348C 'code':143C,215C,249C 'concern':374C 'contain':217C 'content':125C 'creat':174C,338C 'credenti':212C 'cve':88C,103C,152C,362C 'date':131C 'default':92C,107C 'delet':287C 'deriv':248C 'descript':137C 'develop':163C,279C,347C 'ecur':371C 'email':366C 'ensur':244C 'exist':266C 'file':181C,268C,290C,336C 'fix':256C 'fork':246C 'former':160C 'go':314C,358C 'go-rwx':313C,357C 'histori':99C,114C,180C 'host':192C 'id':119C 'identifi':151C 'immedi':302C 'impact':218C 'import':127C 'includ':210C 'incorpor':253C 'incorrect':91C,106C 'issu':156C,227C 'kiro':101C,116C,138C,158C,172C,220C,232C,262C,331C 'latest':241C 'launch':259C,330C 'linux':171C,320C 'local':187C,197C 'maco':169C,318C 'might':199C 'model':205C 'new':255C,335C 'output':209C 'owner':273C,296C,308C,340C 'owner-on':339C 'patch':251C 'permiss':93C,108C,183C 'pleas':365C 'pm':135C 'prompt':98C,113C,179C,204C 'pst':136C 'public':130C 'q':162C,278C,346C 'question':372C 'r':312C 'ran':276C,344C 'read':194C,200C 'recommend':237C 'refer':361C 'requir':128C 'resolut':225C 'respons':206C 'restrict':270C,292C,304C 'run':146C,310C,323C,355C 'rwx':315C,359C 'scope':123C 'session':95C,110C,176C,267C 'shell':328C 'sourc':214C 'termin':149C 'tool':208C 'transcript':96C,111C,177C 'type':126C 'umask':324C 'upgrad':238C,261C,301C 'user':188C,198C,202C,257C,274C,298C,342C 'version':166C,219C,234C,242C 'workaround':297C 'x':284C,352C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:05:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-178-aws/#CVE-2026-124848","url":"https://aws.amazon.com/security/security-bulletins/2026-178-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T20:36:01+00:00","fetched_at":"2026-11-10T20:36:01+00:00","note":"AWS: CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI"},{"source":"nvd","external_id":"CVE-2026-124848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124848","severity":null,"published_at":"2026-11-10T20:19:07+00:00","modified_at":"2026-11-10T20:19:07+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:17+00:00","note":null}],"documents":[{"id":117961,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-178-aws/","title":"AWS Security Bulletins: CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI","kind":"vendor","source":"vendor","publisher":null,"text":"CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI\n\nBulletin ID: 2026-178-AWS Publication Date: 11/10/2026 12:00 PM PST Description: Incorrect default file permissions in Kiro CLI before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. Impacted versions: Kiro CLI >= 1.16.0 AND < 2.27.0 Refer to the article for the most up-to-date and complete information.","published_at":"2026-11-10T20:05:36+00:00","relation":"mentions","confidence":null,"note":null},{"id":118058,"url":"https://aws.amazon.com/security/security-bulletins/2026-178-aws/","title":"AWS: CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI\n\n### CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI\n\nBulletin ID: 2026-178-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 12:45 PM PST\n\n Description:\n\nKiro CLI is an AI coding assistant that runs in the terminal.\n\nWe identified CVE-2026-124848, an issue in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux. Kiro CLI created its session transcript and prompt history files with permissions that allowed other local users on the same host to read them. Another local user might read a user's prompts, model responses and tool output, including any credentials or source code they contain.\n\nImpacted versions: Kiro CLI >= 1.16.0 AND < 2.27.0\n\nResolution:\n\nThis issue has been addressed in Kiro CLI version 2.27.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users should launch the upgraded Kiro CLI once so existing session files are restricted to the owner. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.\n\nWorkarounds:\n\nUsers who cannot upgrade immediately can restrict access to the owner by running \"chmod -R go-rwx ~/.kiro\" on macOS and Linux, and by running \"umask 077\" in the shell before launching Kiro CLI so that new files are created owner-only. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also run \"chmod go-rwx ~/.aws/amazonq/.cli_bash_history\".\n\nReferences:\n\n- CVE-2026-124848\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}