CVE-2026-11931: Kiro IDE Authentication Token Cache Exposure (Local Privilege Escalation)

Technical summary

CVE-2026-11931 is a privilege escalation vulnerability rooted in incorrect file permissions (CWE-276). Kiro IDE stores authentication tokens in a cache file with mode 0644 (readable by owner, group, and others) rather than the secure default of 0600 (readable only by owner). On multi-user systems, any local user or process running under a different UID can read this file and extract the authentication token. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the requirement for local access and the fact that confidentiality is the primary impact; integrity and availability are not affected. This is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no active exploitation has been confirmed at publication.

Business impact

In shared or multi-tenant environments—such as development servers, CI/CD runners, or shared build machines—this vulnerability allows unprivileged users to harvest authentication credentials. Compromised tokens could be used to access cloud services, repositories, or APIs that the affected developer or service account normally authenticates to, potentially leading to unauthorized code commits, configuration changes, or data exfiltration. The impact is highest in organizations where developers share infrastructure and where token scope and revocation policies are not strictly enforced.

Affected systems

Kiro IDE on macOS and Linux systems before version 0.11.133 are affected. Windows is not mentioned in the vulnerability description. The risk is proportional to the number of users on each system and the sensitivity of the tokens being cached.

Exploitability

Exploitation requires local access to the affected system, placing this in the local-attack category. An unprivileged user or a malicious process can read the world-readable cache file without special privileges or user interaction. However, the attacker must have some form of shell access or ability to execute commands on the host. Remote exploitation is not possible. The barrier to exploitation is low once local access is obtained, but the initial foothold is typically the harder step in a real attack scenario.

Remediation

Upgrade Kiro IDE to version 0.11.133 or later. After upgrade and restart, the application automatically corrects file permissions on the next token refresh. Users in multi-user environments should consider invalidating all cached tokens by reauthenticating, especially if there is any suspicion that tokens have been exposed. Verify that the upgrade has been applied and that the cache file permissions are now 0600.

Patch guidance

Download and install Kiro IDE version 0.11.133 or later from the official distribution channel. Restart the application after installation. Monitor your authentication logs and token usage to detect any unusual activity. If operating in a high-security environment, force token rotation across all systems simultaneously to ensure old tokens cannot be reused even if they were previously exposed.

Detection guidance

Check the file permissions of the Kiro IDE authentication token cache file (typically located in the user's home directory under a hidden .kiro or similar folder). Use 'ls -la' or equivalent to verify permissions are 0600. Audit system access logs for any instances of other users or processes reading files in developer home directories. On systems running Kiro IDE, inventory all installations and confirm they are at version 0.11.133 or later. Monitor for suspicious token usage patterns in downstream services (cloud platforms, repositories) that might indicate token theft.

Why prioritize this

Although scored as MEDIUM severity, this vulnerability deserves prompt attention in shared infrastructure environments. The fix is straightforward and carries no breaking changes. Organizations should prioritize patching development infrastructure and build systems where token caches are most likely to exist and where multiple users or automated processes operate. In isolated single-user systems, risk is lower but patching remains advisable as a security baseline.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: (1) local attack vector only, reducing overall risk; (2) low complexity to exploit once local access exists; (3) no special privileges required beyond normal user context; (4) high confidentiality impact (authentication tokens are sensitive secrets); (5) no integrity or availability impact. The score appropriately captures that the vulnerability is serious for multi-user systems but not critical in isolation.

Frequently asked questions