Executive Summary

CVE-2026-11931 is a security vulnerability in Kiro IDE on macOS and Linux versions before 0.11.133. The issue is that the authentication token cache file was created with incorrect default permissions, making it world-readable (0644) instead of restricted to the owner only (0600). This means other local users or processes on the same system could potentially access sensitive authentication tokens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized local users or processes to read the authentication token cache file due to its overly permissive file permissions. As a result, attackers could gain access to sensitive authentication tokens, potentially leading to unauthorized access or actions within the Kiro IDE environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the permissions of the authentication token cache file used by Kiro IDE on macOS or Linux systems. Specifically, you should verify if the file permissions are set to world-readable (0644) instead of owner-restricted (0600).

You can use commands like the following to detect the vulnerable permission settings:

• Find the token cache file location used by Kiro IDE.
• Run: ls -l /path/to/token_cache_file
• Check if the permissions show '-rw-r--r--' (0644) instead of '-rw-------' (0600).

Alternatively, you can use the find command to locate files with world-readable permissions, for example:

• find /path/to/kiro/cache/ -type f -perm 0644

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should immediately upgrade Kiro IDE to version 0.11.133 or later, where the issue has been fixed.

After upgrading and restarting the application, the cache file permissions will be automatically updated on the next token refresh.

If you operate in a multi-user environment, it is recommended to invalidate existing tokens by reauthenticating to ensure that any potentially exposed tokens are no longer valid.

Useful 0 Not Useful 0