CVE-2026-48790

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48790
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48790.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48790
Aliases
Downstream
Related
Published
2026-08-11T17:25:27Z
Modified
2026-09-11T03:30:54Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Details

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-276",
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48790.json"
}
References

Affected packages

Git / github.com/tursodatabase/turso-cli

Affected ranges

Type
GIT
Repo
https://github.com/tursodatabase/turso-cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ffb914849216ef5a86353b3fa6cee66f33af3b66
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.26"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.9
v0.100.0
v0.100.1
v0.12
v0.13
v0.14
v0.15
v0.16
v0.17
v0.18
v0.19
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.37.1
v0.37.2
v0.38.1
v0.39.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.1
v0.44.2
v0.44.3
v0.45.0
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.54.1
v0.55.0
v0.55.1
v0.56.0
v0.57.0
v0.58.0
v0.59.0
v0.60.0
v0.61.0
v0.61.1
v0.61.2
v0.61.3
v0.61.6
v0.62.1
v0.62.2
v0.63.0
v0.64.0
v0.66.0
v0.67.0
v0.68.0
v0.69.0
v0.70.0
v0.71.0
v0.72.0
v0.72.1
v0.72.2
v0.72.3
v0.72.4
v0.73.0
v0.73.1
v0.73.2
v0.74.0
v0.75.0
v0.76.0
v0.77.0
v0.78.0
v0.78.1
v0.78.2
v0.79.0
v0.79.1
v0.80.0
v0.80.1
v0.81.0
v0.82.0
v0.83.0
v0.84.0
v0.84.1
v0.85.0
v0.85.1
v0.85.2
v0.85.3
v0.86.0
v0.86.1
v0.86.2
v0.86.3
v0.87.0
v0.87.1
v0.87.2
v0.87.3
v0.87.4
v0.87.5
v0.87.6
v0.87.7
v0.87.8
v0.87.9
v0.88.0
v0.88.1
v0.88.2
v0.88.3
v0.88.4
v0.88.5
v0.88.6
v0.88.8
v0.88.9
v0.89.0
v0.90.0
v0.90.2
v0.90.3
v0.90.4
v0.90.5
v0.90.6
v0.90.7
v0.91.0
v0.91.1
v0.92.0
v0.92.1
v0.93.0
v0.94.0
v0.95.0
v0.95.1
v0.95.2
v0.96.0
v0.96.1
v0.96.2
v0.96.3
v0.96.4
v0.96.5
v0.97.0
v0.97.1
v0.97.2
v0.98.0
v0.98.1
v0.98.2
v0.99.0
v0.99.1
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.20
v1.0.21
v1.0.22
v1.0.23
v1.0.24
v1.0.25
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48790.json"