Live › vulnerability › GHSA-9g5j-qgqm-857j
Go to dashboardThe AWS Toolkit for Visual Studio Code cached a user's CodeCatalyst bearer token to a file with world-readable permissions and did not delete it after a Dev Environment session ended. A local user or process on the same machine can read that file and take the token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC. All times on this page are UTC.
Developers who connected the AWS Toolkit for Visual Studio Code to a CodeCatalyst Dev Environment on a machine with other local users or processes. Machines without CodeCatalyst connections, and those already on version 4.10.0 or later, are not exposed.
No product ranges from the sources yet.
4.10.0 are affected.codecatalyst..token in the AWS Toolkit extension's Visual Studio Code global storage directory and check their permissions.4.10.0 or later.codecatalyst..token files in the extension's global storage directory after each session.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code
Bulletin ID: 2026-129-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 10:30 AM PDT
Description:
AWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-107332, an issue in the CodeCatalyst connection handler. When a user connected to a CodeCatalyst Dev Environment, the extension cached the user's CodeCatalyst bearer token to a file with world-readable permissions and did not remove the file after the session ended. A local user or process on the same machine with access to the file system was able to read this file and obtain the bearer token.
Impacted versions: < 4.10.0
Resolution:
This issue has been addressed in AWS Toolkit for Visual Studio Code version 4.10.0, released on July 9, 2026. Version 4.10.0 writes the token cache file with owner-only permissions and deletes it when the Dev Environment is stopped. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Users who cannot upgrade immediately can delete any files named codecatalyst..token in the AWS Toolkit extension's Visual Studio Code global storage directory after each session.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-9g5j-qgqm-857j")