CVE-2026-124848

The Kiro CLI (formerly Amazon Q Developer CLI) versions prior to 2.27.0 on macOS and Linux are vulnerable to incorrect default file permissions (CWE-276 ). The CLI creates local session storage files with permissions that allow other local users on the same host to read session transcripts and pr...