CVE-2026-13769: Overly permissive File Permissions in AWS CLI
Summary The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials.
Impact On Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600): - aws codeartifact login
- aws iam create-virtual-mfa-device
- aws deploy register
Any other local user on the same host could read these files and obtain the credentials.
Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2)
Patches This issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Other sources
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).
To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/awsclito a version that resolves this vulnerability.Fixed in 1.44.78 - Upgrade
Upgrade
aws cli v1to a version that resolves this vulnerability.Fixed in 1.44.78 - Upgrade
Upgrade
aws cli v2to a version that resolves this vulnerability.Fixed in 2.34.29 - Operational
If you used the affected CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register) on a Unix-like system with default umask, assume credentials may have been exposed to other local users and rotate any credentials that may have been written to world-readable files before upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13769?
The severity of CVE-2026-13769 is medium, with a CVSS score of 5.5.
How do I fix CVE-2026-13769?
To fix CVE-2026-13769, update AWS CLI to version 1.44.78 or later for v1, and version 2.34.29 or later for v2.
What are the consequences of CVE-2026-13769?
CVE-2026-13769 could allow local users on the same host to read AWS credentials due to overly permissive file permissions.
Which versions of AWS CLI are affected by CVE-2026-13769?
CVE-2026-13769 affects AWS CLI versions prior to 1.44.78 for v1 and 2.34.29 for v2.
What system configurations can mitigate CVE-2026-13769?
Configuring the umask to restrict file permissions can help mitigate the risks associated with CVE-2026-13769.