CVE-2026-48790: CWE-276: Incorrect Default Permissions in tursodatabase turso-cli
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
AI Analysis
Technical Summary
Turso CLI versions before 1.0.26 persist the user's Turso platform JWT token in a settings.json file with default file permissions of 0o644 (readable by all users). This incorrect default permission setting (CWE-276) leads to exposure of sensitive credentials to any local user on the system, enabling unauthorized access to the Turso platform scoped to the user's organizations. The vulnerability is addressed by changing the file permissions in version 1.0.26.
Potential Impact
An attacker with local access to the host system can read the settings.json file containing the Turso platform JWT token due to overly permissive file permissions. This token grants full access to the user's organizations on the Turso platform, potentially allowing unauthorized platform actions within the scope of the compromised JWT. There is no indication of remote exploitation or impact on availability or integrity.
Mitigation Recommendations
Upgrade turso-cli to version 1.0.26 or later, where the issue is patched by setting more restrictive file permissions for the JWT storage file. No other mitigation is required as the vulnerability is fixed in this official release.
CVE-2026-48790: CWE-276: Incorrect Default Permissions in tursodatabase turso-cli
Description
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
CVSS v3.1
Score 5.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Turso CLI versions before 1.0.26 persist the user's Turso platform JWT token in a settings.json file with default file permissions of 0o644 (readable by all users). This incorrect default permission setting (CWE-276) leads to exposure of sensitive credentials to any local user on the system, enabling unauthorized access to the Turso platform scoped to the user's organizations. The vulnerability is addressed by changing the file permissions in version 1.0.26.
Potential Impact
An attacker with local access to the host system can read the settings.json file containing the Turso platform JWT token due to overly permissive file permissions. This token grants full access to the user's organizations on the Turso platform, potentially allowing unauthorized platform actions within the scope of the compromised JWT. There is no indication of remote exploitation or impact on availability or integrity.
Mitigation Recommendations
Upgrade turso-cli to version 1.0.26 or later, where the issue is patched by setting more restrictive file permissions for the JWT storage file. No other mitigation is required as the vulnerability is fixed in this official release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-57f6-pvx8-hwj6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48790"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a3ef76a27e9c79719fee804
Added to database: 06/26/2026, 22:04:26 UTC
Last enriched: 08/11/2026, 19:07:55 UTC
Last updated: 09/13/2026, 10:01:31 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.