CVE-2026-107332
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
- Record
CVE-2026-107332- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-276, CWE-459
- Updated
- 2026-11-02
EUVDEUVD-2026-95128
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
- Record
EUVD-2026-95128- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
- Record
CVE-2026-107332- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-276, CWE-459
- Updated
- 2026-11-02
OSV
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
- Record
CVE-2026-107332- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-276, CWE-459
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107332 is a medium vulnerability (CVSS 6.8) in Aws Aws-toolkit-vscode, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.
References
github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0
aws.amazon.com/security/security-bulletins/2026-129-aws
nvd.nist.gov/vuln/detail/CVE-2026-107332