CVE-2026-107332CWE-276CWE-459

CVE-2026-107332

Medium · published October 8, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.

To mitigate this issue, users should upgrade to version 4.10.0 or later.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00106 · 1.0th percentile
Weaknesses
CWE-276 · Incorrect Default Permissions; CWE-459 · Incomplete Cleanup
Published
2026-10-08T22:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-129-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 17:33Z
    Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
    cvelistv5
  • 08 OCT 17:33Z
    Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
    cvelistv5