What happened
The AWS bulletin (2026-178, Nov 10) documents CVE-2026-124848 (CWE-276 improper default permissions): Kiro CLI, an AI coding assistant, created its session transcript and prompt history files with permissions that let other local users on the same Host read them, exposing a user's prompts, model responses and tool output including any credentials or source code they contain. Fixed in Kiro CLI 2.27.0.
Why it matters
AI coding agents hold the highest-value secrets on a developer workstation — the prompts, credentials, and tool output from sessions — and this flaw makes that material readable to any other local account. On shared CI runners, jump hosts, or multi-developer workstations this turns an AI session log into a credential-leak vector.
Attack vector
Kiro CLI created its session transcript and prompt-history files with default permissions that allowed other local users on the same host to read them. A local user with filesystem access can read another user's AI coding prompts, model responses, and tool output — which frequently contain API keys, cloud credentials, and source code the developer pasted or that was surfaced during the agent session.
Affected systems
Kiro CLI >= 1.16.0 and < 2.27.0 (formerly Amazon Q Developer CLI; Amazon Q Developer CLI 1.16.0–1.19.x also affected for ~/.aws/amazonq/.cli_bash_history).
Mitigation
Upgrade to Kiro CLI 2.27.0 (launch once so existing files are owner-restricted); if unable to upgrade immediately, run 'chmod -R go-rwx ~/.kiro' and 'umask 077' before launch; Amazon Q Developer CLI 1.16.0–1.19.x users should delete or chmod go-rwx ~/.aws/amazonq/.cli_bash_history.