Medium
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Type: advisorySources: OSV
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-107332
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 15:32 UTC · Revision 1
Source evidence
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
core-osv · Original sourcePublished 8 Oct 2026, 17:33 UTC
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.
osv:CVE-2026-107332
Complete source record
{
"id": "da6c84a13aeaa9615ec634fe3ee90e4cd0c0d2765878a5a1524ca1cdc3312010",
"url": "https://osv.dev/vulnerability/CVE-2026-107332",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code",
"summary": "Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.",
"evidence": "osv:CVE-2026-107332",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-107332",
"aliases": [
"CVE-2026-107332",
"GHSA-9g5j-qgqm-857j"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/aws/aws-toolkit-vscode",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "69370e2dee52e3c6577b4b7d2882492855c90453"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.10.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.10.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"rc-20260708",
"prerelease",
"pre-toolkitOnly",
"toolkit/v3.88.0",
"toolkit/v3.87.0",
"rc-202511211",
"amazonq/v1.104.0",
"rc-20250828",
"rc-20250822",
"amazonq/v1.89.0",
"rc-20250813",
"toolkit/v3.71.0",
"amazonq/v1.87.0",
"toolkit/v3.70.0",
"amazonq/v1.85.0",
"amazonq/v1.84.0",
"toolkit/v3.69.0",
"amazonq/v1.83.0",
"amazonq/v1.82.0",
"toolkit/v3.68.0",
"amazonq/v1.81.0",
"amazonq/v1.80.0",
"amazonq/v1.79.0",
"amazonq/v1.78.0",
"amazonq/v1.77.0",
"amazonq/v1.76.0",
"amazonq/v1.75.0",
"toolkit/v3.65.0",
"amazonq/v1.74.0",
"amazonq/v1.73.0",
"amazonq/v1.72.0",
"toolkit/v3.64.0",
"amazonq/v1.70.0",
"toolkit/v3.63.0",
"amazonq/v1.68.0",
"amazonq/v1.67.0",
"amazonq/v1.66.0",
"amazonq/v1.65.0",
"amazonq/v1.64.0",
"toolkit/v3.57.0",
"pre-hybridChat",
"toolkit/v3.56.0",
"amazonq/v1.61.0",
"toolkit/v3.55.0",
"amazonq/v1.59.0",
"amazonq/v1.58.0",
"amazonq/v1.57.0",
"amazonq/v1.56.0",
"amazonq/v1.55.0",
"amazonq/v1.48.0",
"toolkit/v3.46.0",
"amazonq/v1.46.0",
"amazonq/v1.45.0",
"amazonq/v1.44.0",
"toolkit/v3.42.0",
"amazonq/v1.42.0",
"amazonq/v1.41.0",
"toolkit/v3.39.0",
"pre-postreinvent",
"toolkit/v3.38.0",
"toolkit/v3.36.0",
"toolkit/v3.35.0",
"amazonq/v1.36.0",
"toolkit/v3.33.0",
"amazonq/v1.34.0",
"amazonq/v1.33.0",
"amazonq/v1.32.0",
"toolkit/v3.30.0",
"amazonq/v1.30.0",
"amazonq/v1.29.0",
"amazonq/v1.28.0",
"amazonq/v1.27.0",
"amazonq/v1.26.0",
"amazonq/v1.25.0",
"toolkit/v3.23.0",
"amazonq/v1.23.0",
"amazonq/v1.22.0",
"amazonq/v1.21.0",
"amazonq/v1.20.0",
"amazonq/v1.19.0",
"amazonq/v1.18.0",
"amazonq/v1.17.0",
"toolkit/v3.16.0",
"toolkit/v3.15.0",
"amazonq/v1.15.0",
"toolkit/v3.14.0",
"amazonq/v1.13.0",
"toolkit/v3.13.0",
"amazonq/v1.12.0",
"amazonq/v1.11.0",
"amazonq/v1.10.0",
"amazonq/v1.9.0",
"amazonq/v1.8.0",
"amazonq/v1.7.0",
"toolkit/v3.8.0",
"toolkit/v3.6.0",
"amazonq/v1.6.0",
"toolkit/v3.5.0",
"amazonq/v1.5.0",
"amazonq/v1.4.0",
"toolkit/v3.3.0",
"amazonq/v1.3.0",
"amazonq/v1.2.0",
"toolkit/v3.2.0",
"amazonq/v1.1.0",
"toolkit/v3.1.0",
"v3.0.0",
"amazonq/v1.0.0",
"v2.20.0",
"v2.19.0",
"v2.18.0",
"v2.17.0",
"v2.16.0",
"v2.15.0",
"v2.14.0",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.0",
"v2.9.0",
"v2.7.0",
"v2.6.0",
"v2.4.0",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v1.100.0",
"v2.0.0",
"v1.99.0",
"v1.98.0",
"v1.97.0",
"v1.96.0",
"v1.95.0",
"v1.94.0",
"v1.93.0",
"v1.92.0",
"v1.91.0",
"v1.90.0",
"v1.89.0",
"v1.80.0",
"v1.88.0",
"v1.87.0",
"v1.86.0",
"v1.85.0",
"v1.84.0",
"v1.83.0",
"v1.82.0",
"v1.81.0",
"v1.79.0",
"v1.78.0",
"v1.77.0",
"v1.76.0",
"v1.75.0",
"v1.74.0",
"v1.73.0",
"v1.72.0",
"v1.71.0",
"v1.70.0",
"v1.69.0",
"v1.68.0",
"v1.67.0",
"v1.66.0",
"v1.65.0",
"v1.64.0",
"v1.63.0",
"v1.62.0",
"v1.61.0",
"v1.60.0",
"v1.59.0",
"v1.58.0",
"v1.57.0",
"v1.29.0",
"v1.27.0",
"v1.26.0",
"v1.25.0",
"v1.24.0",
"v1.23.0",
"v1.22.0",
"v1.21.0",
"v1.20.0",
"v1.19.0",
"v1.18.0",
"v1.17.0",
"v1.16.0",
"v1.15.0",
"v1.14.0",
"v1.12.0",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.1",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107332.json"
}
}
],
"modified": "2026-10-28T02:30:20.546641392Z",
"provider": "osv",
"references": [
"https://aws.amazon.com/security/security-bulletins/2026-129-aws/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107332.json",
"https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j",
"https://nvd.nist.gov/vuln/detail/CVE-2026-107332",
"https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0"
],
"provider_metadata": {
"cwe_ids": [
"CWE-276",
"CWE-459"
],
"cna_assigner": "AMZN",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107332.json"
}
},
"related_cves": [
{
"value": "CVE-2026-107332",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 486571,
"published_at": "2026-10-08T17:33:30.417+00:00"
}