Is there a patch available for CVE-2026-11931?

Yes, a patch is available for CVE-2026-11931. Update the affected software to the latest version immediately.

Kiro IDE CVE-2026-11931

Q: What is the CVSS score of CVE-2026-11931?

CVE-2026-11931 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36791 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-06-15 AMZN

GHSA-vjw4-v5gx-3v45

Privilege Escalation AWS Apple Kiro Ide

6.8

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local attack against a shared filesystem file; low-privilege local user sufficient; high confidentiality from token exposure; no integrity or availability impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 15, 2026 - 21:01 EUVD

Analysis Generated

Jun 15, 2026 - 19:59 vuln.today

CVE Published

Jun 15, 2026 - 18:33 cve.org

MEDIUM 6.8

DescriptionCVE.org

Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).

To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.

AnalysisAI

Authentication token cache file exposure in Kiro IDE on macOS and Linux allows any local user to read credentials belonging to other users due to world-readable file permissions (0644) instead of the security-appropriate owner-only permissions (0600). All versions before 0.11.133 are affected on UNIX-based platforms; the vulnerability is confirmed by AWS via security bulletin 2026-045 and has been assigned CWE-276 (Incorrect Default Permissions). No public exploit code has been identified at time of analysis, but exploitation requires no technical sophistication - only filesystem read access on a shared system.

Technical ContextAI

Kiro IDE (cpe:2.3:a:aws:kiro_ide:*:*:*:*:*:*:*:*) is an AWS-developed integrated development environment. The root cause is CWE-276 (Incorrect Default Permissions): at file creation time, the application fails to apply a restrictive umask or explicit permission mask, leaving the authentication token cache file with POSIX mode 0644 (owner read/write, group read, world read) instead of 0600 (owner read/write only). On macOS and Linux, the POSIX discretionary access control model permits any process running under any UID on the same system to open and read a 0644 file. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H confirms the attack is purely local, requires no elevated privilege, no special attack conditions, and yields high confidentiality impact on the vulnerable system with no integrity or availability impact.

RemediationAI

Vendor-released patch: Kiro IDE version 0.11.133. Users should upgrade through the standard IDE update mechanism and restart the application; the cache file permissions are automatically corrected to 0600 on the next token refresh after upgrade, requiring no manual intervention. Users operating in multi-user environments should additionally reauthenticate to invalidate any authentication tokens that may have been readable under the old 0644 permissions, mitigating exposure from any token that was already harvested. As an interim workaround before patching, administrators can manually restrict the existing cache file with chmod 0600 <path-to-token-cache> - the trade-off is that this must be re-applied if Kiro regenerates the file before the upgrade. Full advisory details are available at https://aws.amazon.com/security/security-bulletins/2026-045-aws/ and the patch changelog is at https://kiro.dev/changelog/ide/0-11/#patch-0-11-133.