CVE-2026-11931: Insecure Permissions on Authentication Token Cache File in Kiro IDE
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).
To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiro IDEto a version that resolves this vulnerability.Fixed in 0.11.133 - Operational
Restart the Kiro IDE after upgrading; the cache file permissions will be automatically updated on the next token refresh.
- Operational
Invalidate existing tokens by reauthenticating (recommended for multi-user environments) to ensure previously exposed tokens are revoked.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11931?
The severity of CVE-2026-11931 is rated as medium with a score of 5.5.
How do I fix CVE-2026-11931?
To fix CVE-2026-11931, users should upgrade Kiro IDE to version 0.11.133 or later.
What does CVE-2026-11931 expose to local users?
CVE-2026-11931 exposes the authentication token cache file to other local users or processes due to insecure permissions.
Which platforms are affected by CVE-2026-11931?
CVE-2026-11931 affects Kiro IDE on macOS and Linux before version 0.11.133.
What are the default permissions associated with CVE-2026-11931?
The default permissions associated with CVE-2026-11931 are world-readable permissions set to 0644 instead of restricted owner permissions.