CVE-2026-11931: Kiro IDE Information Disclosure Flaw

CVE-2026-11931 Overview

CVE-2026-11931 is an insecure permissions vulnerability in Kiro IDE on macOS and Linux platforms before version 0.11.133. The application writes its authentication token cache file with world-readable permissions (0644) instead of owner-restricted permissions (0600). Any local user or process on the affected system can read the cached authentication token. An attacker who obtains the token can impersonate the developer against backend services authorized by that token. The flaw is categorized under CWE-276: Incorrect Default Permissions.

Critical Impact
Local users and processes can read cached authentication tokens, enabling impersonation of the legitimate developer account.

Affected Products

Kiro IDE for macOS before version 0.11.133
Kiro IDE for Linux before version 0.11.133
Multi-user systems where Kiro IDE is installed and used

Discovery Timeline

2026-06-15 - CVE-2026-11931 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11931

Vulnerability Analysis

Kiro IDE caches authentication tokens locally to maintain user sessions across application restarts. On macOS and Linux, the application creates this cache file with file mode 0644, which grants read access to the file owner, the owner's group, and all other local users on the system. The intended permission mode for a credential file is 0600, which restricts access to the file owner alone.

Authentication tokens stored in this cache typically grant access to backend services associated with the IDE. A local attacker reading the file can extract a valid token and replay it against those services, bypassing the standard authentication flow. The attack does not require elevated privileges. Any unprivileged local account or process running on the host satisfies the prerequisites.

The issue is local in scope and limited to confidentiality of the token. It does not by itself allow code execution on the host. However, the captured token expands the attacker's reach to whatever resources the token authorizes.

Root Cause

The root cause is an improper umask or explicit mode argument when the token cache file is created. The application writes the file using default process permissions rather than calling chmod(2) or open(2) with mode 0600 to restrict access to the owning user.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker who already has a shell account on a shared workstation, build server, or jump host can read ~/.kiro cache contents belonging to other users if directory traversal permits, or read their own cache after a coworker has logged in on a shared account. Malicious processes running under any local user, including supply chain implants or installed dependencies, can also harvest the token.

No verified exploit code has been published. The vulnerability mechanism is described in the AWS Security Bulletin 2026-045 and the Kiro IDE Changelog for patch 0.11.133.

Detection Methods for CVE-2026-11931

Indicators of Compromise

Kiro IDE token cache file with mode 0644 instead of 0600 on macOS or Linux hosts
Unexpected read access to the Kiro cache directory from processes outside the IDE
Authentication events from the Kiro backend originating from IP addresses or user agents not associated with the legitimate developer

Detection Strategies

Audit file permissions on Kiro IDE cache files across managed developer workstations and flag any file with group or world read bits set
Monitor process telemetry for non-Kiro processes opening the token cache file path
Correlate Kiro backend authentication logs with endpoint user-session data to identify token reuse from unexpected sources

Monitoring Recommendations

Add file integrity monitoring rules for the Kiro token cache file path on Linux and macOS endpoints
Alert on any local user other than the file owner reading the cache file
Track installed Kiro IDE versions in the asset inventory and flag hosts running versions earlier than 0.11.133

How to Mitigate CVE-2026-11931

Immediate Actions Required

Upgrade Kiro IDE to version 0.11.133 or later on all macOS and Linux endpoints
Restart the application after upgrading so the cache file permissions are corrected on the next token refresh
Reauthenticate from multi-user systems to invalidate any tokens that may have been exposed while the file was world-readable
Review backend authentication logs for suspicious token use during the exposure window

Patch Information

The vendor released Kiro IDE 0.11.133 with corrected file permissions. After upgrade and application restart, the cache file mode is automatically updated to 0600 on the next token refresh. Patch details are available in the Kiro IDE Changelog and the AWS Security Bulletin 2026-045.

Workarounds

Manually set the cache file mode to 0600 using chmod 600 on the affected file until the upgrade is applied
Restrict the parent directory permissions to 0700 to block traversal by other local users
Avoid using Kiro IDE on shared multi-user hosts until patched

bash

# Configuration example
# Verify and harden Kiro IDE token cache permissions on macOS/Linux
chmod 700 ~/.kiro
chmod 600 ~/.kiro/token-cache
ls -la ~/.kiro/token-cache
# Expected: -rw------- 1 <user> <group> ... token-cache