CVE-2026-124848

Other local users could read Kiro prompts and session transcripts

Amazon · Kiro CLI on macOS and Linux

First documented disclosure · Review checkpoint

Summary

Local history files were created with permissions that allowed other accounts to read them. Prompts, responses and tool output could expose source code or credentials stored in the transcript.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Local history files were created with permissions that allowed other accounts to read them.

Conditions required

A second user had file access on a shared host running Kiro CLI or its Amazon Q Developer predecessor.

Potential impact

Prompts, responses and tool output could expose source code or credentials stored in the transcript.

Affected versions and configurations

1.16.0 through versions before 2.27.0 on macOS and Linux.

Fix and mitigation status

2.27.0.

Practical next steps

Upgrade and launch Kiro once to repair permissions. Restrict or remove the separate legacy history file left by Amazon Q Developer CLI 1.16.0–1.19.x.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The October 1 release of 2.27.0 predates the November public security bulletin. Launching the patched CLI repairs existing session file permissions. The CVE record was published on 2026-11-10.

Sources