Confirmed 100Patch availableVulnerabilityFirst seen 10 Nov 2026, 20:05 UTC

CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI

Coverage

Headline	Source	Type	Published
CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI	AWS Security Bulletins	Official	10 Nov 2026, 20:05 UTC

Vulnerabilities and remediation

CVE-2026-124848 Patch available CVSS pending

Fixed in: Kiro CLI 2.27.0
Your version: Check if your Kiro CLI version is affected →
Checked: Vendor record (AMZN) checked 4 h ago

Fix status, versions and advisories from NVD; required actions from CISA. EPSS is FIRST’s estimate of the chance of exploitation in the next 30 days. Always confirm with the vendor advisory.

Why this score

Confidence	100 · Confirmed
Most trusted source	90
Independent organisations reporting it (1)	+0
Confirmed by an official source or CISA KEV	+10

We link to the original reporting and don’t reproduce it. Read the sources above for the full details.