CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI
CVE-2026-124848
Summary
Bulletin ID: 2026-118-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/24/2026 12:00 PM PDT
Description:
pgcollection is an open source extension to PostgreSQL. We identified CVE-2026-96883, an issue in pgcollection's type coercion logic.
When requesting a stored icollection value as a type incompatible with how it was actually stored causes the extension to misinterprets the datum's representation, allowing an authenticated database user to crash the PostgreSQL backend or execute arbitrary code.
Impacted versions: pgcollection v2.0.0 through v2.1.1
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
View article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.