VULNERABILITY INTELLIGENCE
CVE-2026-11931
CVSS score5.5 MEDIUM
EPSS probability0.12%
CISA KEVNot currently listed
Published2026-06-15
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
Weakness classification
- ff89ba41-3aa1-4d27-914a-91399e9639e5: CWE-276