CVE-2026-107332: Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-276

Description

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.

Affected products

aws-toolkit-vscode: before 4.10.0 — fixed in 4.10.0

How to fix

Upgrade to a fixed version: aws-toolkit-vscode 4.10.0. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/2026-129-aws/
https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0
https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j

Get alerted when CVE-2026-107332 or the next vulnerability affects your stack