CVE-2026-11931 - Insecure Permissions on Authentication Token Cache File in Kiro IDE
Bulletin ID: 2026-045-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions: < 0.11.133 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CSIRTS triage
- What
- Incorrect default permissions could expose the authentication token cache file to other local users.
- Who is affected
- Users of Kiro IDE on macOS and Linux before version 0.11.133.
- Urgency
- Remediation is important to prevent unauthorized access to sensitive information.
- Action
- Update Kiro IDE to version 0.11.133 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Kiro IDE
Get an email when a new Kiro IDE advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-045-aws/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-119310.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-11931 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for - Insecure Permissions
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-89259: Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permissi…nvd · 2026-09-11
- mediumCVE-2026-86812: The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order…nvd · 2026-09-11
- highCVE-2026-11813: A potential improper permissions vulnerability was reported in the Lenovo Filez Client applica…nvd · 2026-09-10
- highCVE-2026-73693: FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet …nvd · 2026-09-10
- highCVE-2026-88939: knowns through 0.33.0 exempts the project.set action from permission guard checks unconditiona…nvd · 2026-09-10
- highCVE-2026-79987: A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permiss…nvd · 2026-09-10
More from AWS Security Bulletins
- unknownCVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Syste…2026-09-10
- unknownCVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library2026-09-10
- unknownCVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK2026-09-09
- highCVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit2026-09-09
- unknownCVE-2026-18953 - Improper limitation of a pathname in AWS Transform MCP Server2026-09-09