AWS fixes Kiro CLI flaw that left session transcripts world-readable

AWS fixes Kiro CLI flaw that left session transcripts world-readable

10 November 2026: AWS has fixed CVE-2026-124848, an issue in Kiro CLI that let other local users on the same macOS or Linux host read a user's session transcripts and prompt history, which can include credentials and source code. The affected range is Kiro CLI 1.16.0 up to but not including 2.27.0, and the fix is in 2.27.0. AWS rates its bulletin 2026-178-AWS as Important (requires attention) and gives no CVSS score.

How the files were exposed

Kiro CLI is an AI coding assistant that runs in the terminal and was formerly called Amazon Q Developer CLI. According to AWS, it created its session transcript and prompt-history files with permissions that allowed other local users on the same host to read them. Another user could then read a person's prompts, the model's responses and the output of tools the assistant ran, along with any credentials or source code they contain.

The risk therefore sits on machines that more than one person can log into: shared build servers, jump hosts, university or training machines and multi-user development boxes. A single-user laptop is much less exposed, though AWS does not say so.

Versions and the fix

• Affected: Kiro CLI 1.16.0 or later and earlier than 2.27.0, on macOS and Linux.
• Fixed: Kiro CLI 2.27.0.

AWS recommends upgrading to the latest version and making sure any forked or derivative code includes the fixes. One detail changes the job: users should launch the upgraded Kiro CLI once, so that existing session files are restricted to the owner. Installing the update alone leaves the older files as they were.

Cleaning up older history files

People who ran Amazon Q Developer CLI 1.16.0 through 1.19.x have a second file to deal with. AWS tells them to delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.

If you cannot upgrade yet

AWS gives two workarounds for users who cannot upgrade immediately. Run chmod -R go-rwx ~/.kiro on macOS and Linux to restrict the existing files to the owner, and run umask 077 in the shell before launching Kiro CLI so that new files are created owner-only. Users of the older tool also run chmod go-rwx ~/.aws/amazonq/.cli_bash_history.

What to check on shared hosts

Because the files hold whatever a developer pasted into a session, a shared host that ran an affected version may have exposed secrets to other accounts on it. AWS does not report any exploitation and does not say how to detect reading of the files, so the safe course is to rotate any credential that appeared in a prompt or in tool output on a machine other users could access.

The bulletin lists no other affected AWS product.

Sources

• AWS Security Bulletin 2026-178-AWS: CVE-2026-124848, Incorrect default permissions on session transcripts and prompt history in Kiro CLI, 10 November 2026, 10 November 2026