Medium severity · published Jun 15, 2026
CVE-2026-11931
Insecure Permissions on Authentication Token Cache File in Kiro IDE
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).
To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kiro IDE · AWS
before 0.11.133 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11931
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-045-aws/
kiro.dev
https://kiro.dev/changelog/ide/0-11/#patch-0-11-133
More from Kiro IDE
8.8
CVE-2026-10591
Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
7.8
CVE-2026-5429
Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
7.8
CVE-2026-4295
Arbitrary code execution via crafted project files in Kiro IDE
7.8
CVE-2026-0830
Command Injection in Kiro GitLab Merge Request Helper
5.5
CVE-2026-89332
Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration