{"id":"CVE-2026-107332","revision":"05b176c7d1574d15a63771c13861f35e","records":[{"revision":"05b176c7d1574d15a63771c13861f35e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107332","aliases":[],"title":"Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code","description":"Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.\n\n\n\nTo mitigate this issue, users should upgrade to version 4.10.0 or later.","state":0,"publishedAt":"2026-10-08T17:33:30.417+00:00","modifiedAt":"2026-10-09T16:18:46.826+00:00","affected":[{"ecosystem":"Vendor product","name":"aws-toolkit-vscode","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"aws\",\n                    \"product\": \"aws-toolkit-vscode\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.10.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.8,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0","https://aws.amazon.com/security/security-bulletins/2026-129-aws/","https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107332","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107332","identifiers":["CVE-2026-107332"]},"retained":false,"historicalAffected":[]}],"coverage":[]}