CVE-2026-107332: CWE-276 Incorrect default permissions in aws aws-toolkit-vscode
Description
Bulletin ID: 2026-129-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 10:30 PM PDT Description: AWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-107332, an issue in the CodeCatalyst connection handler. When a user connected to a CodeCatalyst Dev Environment, the extension cached the user's CodeCatalyst bearer token to a file with world-readable permissions and did not remove the file after the session ended. A local user or process on the same machine with access to the file system was able to read this file and obtain the bearer token. Impacted versions: < 4.10.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVSS v4.0
Score 6.8medium
Affected software
aws
aws-toolkit-vscode
pkg:github/aws/aws-toolkit-vscodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AWS Toolkit for Visual Studio Code, an open source extension for working with AWS services, has a security flaw (CVE-2026-107332) in its CodeCatalyst connection handler. The extension caches the user's CodeCatalyst bearer token to a file with incorrect default permissions (world-readable) and does not remove the file after the session ends. This improper handling of sensitive tokens enables local users or processes on the same machine to read the token file and obtain the bearer token. The vulnerability affects all versions before 4.10.0.
Potential Impact
An attacker with local access to the file system can read the cached bearer token file and obtain the CodeCatalyst bearer token. This could allow unauthorized access to AWS CodeCatalyst resources under the affected user's credentials. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector but high impact due to token exposure.
Mitigation Recommendations
A patch is available that fixes the issue by correcting file permissions and ensuring the token file is removed after the session ends. Users should upgrade AWS Toolkit for Visual Studio Code to version 4.10.0 or later. Since this is a client-side extension, remediation requires updating the software on affected machines.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-10-07T18:21:27.879Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-129-aws/","vendor":"AWS"}]
Threat ID: 6ac7d8742cdf04f6562d26bb
Added to database: 10/08/2026, 17:52:52 UTC
Last enriched: 10/08/2026, 17:54:17 UTC
Last updated: 10/08/2026, 23:50:31 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.