Kiro CLI: Incorrect file permissions expose session transcripts to local users
Summary
Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux stores session transcripts and prompt history with permissions that allow other local users on the same host to read them. An attacker with a local low-privileged account can read prompts, model responses and tool output, which may include credentials or source code. The risk is mainly relevant on shared multi-user hosts; the vulnerability is not remotely exploitable.
Affected
- Kiro CLI from 1.16.0 before 2.27.0 on macOS and Linux
- Amazon Q Developer CLI 1.16.0 through 1.19.x (legacy history file)
- Default configuration is unaffected according to the CVE record
Fixed in
- Kiro CLI 2.27.0 or later (launch the upgraded CLI once so existing session files are restricted to the owner)
- Exact fixed build: verify against the vendor bulletin, as later releases exist
Workaround
- Run "chmod -R go-rwx ~/.kiro" on macOS and Linux
- Run "umask 077" in the shell before launching Kiro CLI
- Legacy Amazon Q Developer CLI 1.16.0 through 1.19.x: run "chmod go-rwx ~/.aws/amazonq/.cli_bash_history"
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found in the research performed.
- Attack requires local access with a low-privileged account.
Our recommendation
- Inventory all Kiro CLI and Amazon Q Developer CLI installations, prioritising shared multi-user hosts such as dev servers, jump hosts and build runners.
- Upgrade to Kiro CLI 2.27.0 or later and launch it once.
- On hosts that ran Amazon Q Developer CLI 1.16.0 through 1.19.x, delete ~/.aws/amazonq/.cli_bash_history or restrict it to the owner.
- Review the vendor bulletin for the exact fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-178-AWS aws.amazon.com
- CVE Record CVE-2026-124848 www.cve.org
- Kiro CLI 2.27 changelog kiro.dev
- Strix CVE summary www.strix.ai
- OffSeq Radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:16.
Original description (NVD)
Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. To remediate this issue, users should upgrade to Kiro CLI version 2.27.0 or later and launch it once. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.