CVE-2026-107332

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107332
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107332.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107332
Aliases
  • GHSA-9g5j-qgqm-857j
Published
2026-10-08T17:33:30Z
Modified
2026-10-11T02:30:40Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Details

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.

To mitigate this issue, users should upgrade to version 4.10.0 or later.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-276",
        "CWE-459"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107332.json"
}
References

Affected packages

Git / github.com/aws/aws-toolkit-vscode

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-toolkit-vscode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
69370e2dee52e3c6577b4b7d2882492855c90453
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.10.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

amazonq/v1.*
amazonq/v1.0.0
amazonq/v1.1.0
amazonq/v1.10.0
amazonq/v1.104.0
amazonq/v1.11.0
amazonq/v1.12.0
amazonq/v1.13.0
amazonq/v1.15.0
amazonq/v1.17.0
amazonq/v1.18.0
amazonq/v1.19.0
amazonq/v1.2.0
amazonq/v1.20.0
amazonq/v1.21.0
amazonq/v1.22.0
amazonq/v1.23.0
amazonq/v1.25.0
amazonq/v1.26.0
amazonq/v1.27.0
amazonq/v1.28.0
amazonq/v1.29.0
amazonq/v1.3.0
amazonq/v1.30.0
amazonq/v1.32.0
amazonq/v1.33.0
amazonq/v1.34.0
amazonq/v1.36.0
amazonq/v1.4.0
amazonq/v1.41.0
amazonq/v1.42.0
amazonq/v1.44.0
amazonq/v1.45.0
amazonq/v1.46.0
amazonq/v1.48.0
amazonq/v1.5.0
amazonq/v1.55.0
amazonq/v1.56.0
amazonq/v1.57.0
amazonq/v1.58.0
amazonq/v1.59.0
amazonq/v1.6.0
amazonq/v1.61.0
amazonq/v1.64.0
amazonq/v1.65.0
amazonq/v1.66.0
amazonq/v1.67.0
amazonq/v1.68.0
amazonq/v1.7.0
amazonq/v1.70.0
amazonq/v1.72.0
amazonq/v1.73.0
amazonq/v1.74.0
amazonq/v1.75.0
amazonq/v1.76.0
amazonq/v1.77.0
amazonq/v1.78.0
amazonq/v1.79.0
amazonq/v1.8.0
amazonq/v1.80.0
amazonq/v1.81.0
amazonq/v1.82.0
amazonq/v1.83.0
amazonq/v1.84.0
amazonq/v1.85.0
amazonq/v1.87.0
amazonq/v1.89.0
amazonq/v1.9.0
Other
pre-hybridChat
pre-postreinvent
pre-toolkitOnly
prerelease
rc-20250813
rc-20250822
rc-20250828
rc-202511211
rc-20260708
toolkit/v3.*
toolkit/v3.1.0
toolkit/v3.13.0
toolkit/v3.14.0
toolkit/v3.15.0
toolkit/v3.16.0
toolkit/v3.2.0
toolkit/v3.23.0
toolkit/v3.3.0
toolkit/v3.30.0
toolkit/v3.33.0
toolkit/v3.35.0
toolkit/v3.36.0
toolkit/v3.38.0
toolkit/v3.39.0
toolkit/v3.42.0
toolkit/v3.46.0
toolkit/v3.5.0
toolkit/v3.55.0
toolkit/v3.56.0
toolkit/v3.57.0
toolkit/v3.6.0
toolkit/v3.63.0
toolkit/v3.64.0
toolkit/v3.65.0
toolkit/v3.68.0
toolkit/v3.69.0
toolkit/v3.70.0
toolkit/v3.71.0
toolkit/v3.8.0
toolkit/v3.87.0
toolkit/v3.88.0
v1.*
v1.10.0
v1.100.0
v1.11.0
v1.12.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.29.0
v1.3.0
v1.4.0
v1.5.0
v1.57.0
v1.58.0
v1.59.0
v1.6.0
v1.6.1
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.75.0
v1.76.0
v1.77.0
v1.78.0
v1.79.0
v1.8.0
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.85.0
v1.86.0
v1.87.0
v1.88.0
v1.89.0
v1.9.0
v1.90.0
v1.91.0
v1.92.0
v1.93.0
v1.94.0
v1.95.0
v1.96.0
v1.97.0
v1.98.0
v1.99.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.3.0
v2.4.0
v2.6.0
v2.7.0
v2.9.0
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107332.json"