Description
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.



To mitigate this issue, users should upgrade to version 4.10.0 or later.
Published: 2026-10-08
Score: 6.8 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.
Title Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
First Time appeared Aws
Aws aws-toolkit-vscode
Weaknesses CWE-276
CWE-459
CPEs cpe:2.3:a:aws:aws-toolkit-vscode:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-toolkit-vscode
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aws Aws-toolkit-vscode
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-08T17:33:30.417Z

Reserved: 2026-10-07T18:21:27.879Z

Link: CVE-2026-107332

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-08T18:17:19.443

Modified: 2026-10-08T18:17:19.443

Link: CVE-2026-107332

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses