CVE-2026-126087 - Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker agent
CVE-2026-126087
Summary
Bulletin ID: 2026-178-AWS
Publication Date: 11/10/2026 12:00 PM PST
Description:
Incorrect default file permissions in Kiro CLI before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users.
Impacted versions: Kiro CLI >= 1.16.0 AND < 2.27.0
Refer to the article for the most up-to-date and complete information.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.