Bulletin ID: 2026-045-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 06/15/2026 11:45 AM PDT

Description:

Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents.

We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).

Impacted versions: < 0.11.133

Resolution:

This issue has been addressed in Kiro IDE version 0.11.133. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

References:

• CVE-2026-11931
• Kiro IDE version 0.11.133

Acknowledgement:

We would like to thank Sergio Garcia of BeyondTrust Phantom Labs for collaborating on this issue through the coordinated disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.