What is 2026-178-AWS?

2026-178-AWS is a security advisory published by AWS Security Bulletins. CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI

Which CVE IDs does 2026-178-AWS cover?

2026-178-AWS covers the following CVE IDs: CVE-2026-124848. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-178-AWS

CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI

Vendor

AWS Security Bulletins

Published

November 10, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-124848 →

📋 Description

Bulletin ID: 2026-178-AWS Publication Date: 11/10/2026 12:00 PM PST Description: Incorrect default file permissions in Kiro CLI before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. Impacted versions: Kiro CLI >= 1.16.0 AND
Refer to the article for the most up-to-date and complete information.

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-178-aws/