Skip to main content

AWS CLI CVE-2026-13769

| EUVDEUVD-2026-41116 MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2026-07-01 AMZN GHSA-wfp6-f47h-hxc3
Information Disclosure AWS Red Hat Suse Aws Cli
6.8
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Local attack vector (AV:L) and low-privilege account required (PR:L); only confidentiality impacted as credentials are read-only stolen, no integrity or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 01, 2026 - 19:35 vuln.today
CVSS changed
Jul 01, 2026 - 19:22 NVD
5.5 (MEDIUM) 6.8 (MEDIUM)

DescriptionCVE.org

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

AnalysisAI

Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).

Technical ContextAI

CWE-732 (Incorrect Permission Assignment for Critical Resource) describes the root cause: when the affected subcommands write credential or token files to disk, the AWS CLI does not explicitly enforce restrictive file permissions (e.g., 0600) and instead relies on the inheriting process umask. On most Unix-like systems, the default umask (commonly 0022 or 0002) results in files created with group-readable or world-readable permissions, directly exposing secrets to any user with local filesystem access. The three affected subcommands each produce credential artifacts: aws codeartifact login writes authentication tokens for CodeArtifact package registries, aws iam create-virtual-mfa-device may produce QR code or seed files, and aws deploy register creates deployment credentials. Affected CPE: cpe:2.3:a:aws:aws_cli:*:*:*:*:*:*:*:* across all versions prior to the fixed releases.

RemediationAI

Vendor-released patch: AWS CLI 1.44.78 (v1) and 2.34.29 (v2). Users should upgrade immediately using pip install --upgrade awscli (v1) or the official installer for v2 from the AWS documentation; release notes are at https://github.com/aws/aws-cli/releases/tag/1.44.78 and https://github.com/aws/aws-cli/releases/tag/2.34.29, and the security advisory is at https://aws.amazon.com/security/security-bulletins/2026-049-aws/. As a compensating control prior to patching, administrators can configure a restrictive umask (umask 0077) in shell profiles or session initialization scripts to ensure newly created files default to owner-only permissions - note this may affect other tools that rely on group-readable file creation. Additionally, on shared hosts, review and correct permissions on any credential files already written by the affected subcommands using chmod 600. Avoid running the three affected subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register) on shared multi-user hosts until patched.

More in AWS

View all
CVE-2026-27702 CRITICAL POC
9.9 Feb 25

Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
CVE-2020-37153 CRITICAL POC
9.8 Feb 11

Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
CVE-2026-11393 HIGH POC
8.8 Jun 08

Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
CVE-2026-16756 HIGH POC
8.7 Jul 23

Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
CVE-2026-16796 HIGH POC
8.4 Jul 23

Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary

CVE-2026-9133 HIGH POC
8.3 May 20

Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
CVE-2026-13763 HIGH POC
7.9 Jun 29

WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
CVE-2026-13762 HIGH POC
7.9 Jun 29

WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
CVE-2026-4295 HIGH POC
7.8 Mar 17

A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
CVE-2019-25333 HIGH POC
7.5 Feb 12

Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to

CVE-2026-7461 HIGH POC
7.5 Apr 30

Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
CVE-2026-16584 HIGH POC
7.3 Jul 23

Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API o

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-13769 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy