Insecure Permissions on Authentication Token Cache File in Kiro IDE

Bulletin ID:  2026-045-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931 , where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions:   Resolution: This issue has been addressed in Kiro IDE version 0.11.133 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. References: CVE-2026-11931 Kiro IDE version 0.11.133 Acknowledgement: We would like to thank Sergio Garcia of BeyondTrust Phantom Labs for collaborating on this issue through the coordinated disclosure process. Please email  aws-security@amazon.com  with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-045-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-11931 - Insecure Permissions on Authentication Token Cache File in Kiro IDE Bulletin ID:  2026-045-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931 , where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions:   Resolution: This issue has been addressed in Kiro IDE version 0.11.133 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. References: CVE-2026-11931 Kiro IDE version 0.11.133 Acknowledgement: We would like to thank Sergio Garcia of BeyondTrust Phantom Labs for collaborating on this issue through the coordinated disclosure process. Please email  aws-security@amazon.com  with any security questions or concerns.   {"data":{"items":[{"fields":{"footer":"{ "createAccountButtonLabel": "Create an AWS account", "createAccountButtonURL": "https://signin.aws.amazon.com/signup?request_type=register", "backToTopText": "Back to top", "eoeText": "Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability or other legally protected status. Veterans, military spouses, and people with disabilities are encouraged to apply.", "copyrightText": "© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.", "items": [ { "name": "Learn", "linkURL": "", "items": [ { "heading": "What Is AWS?", "linkURL": "/what-is-aws/?nc1=f_cc" }, { "heading": "What Is Cloud Computing?", "linkURL": "/what-is-cloud-computin

CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity from

NVD

• aws.amazon.com/security/security-bulletins/rss/2026-045-aws/
• www.cve.org/CVERecord?id=CVE-2026-11931