Vulnerability-Lookup

GHSA-WFP6-F47H-HXC3

Vulnerability from github – Published: 2026-07-24 15:49 – Updated: 2026-07-24 15:49

Summary

AWS CLI: Overly permissive File Permissions

Details

Summary

The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials.

Impact

On Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600): - aws codeartifact login

aws iam create-virtual-mfa-device
aws deploy register

Any other local user on the same host could read these files and obtain the credentials.

Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2)

Patches

This issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.44.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "awscli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.44.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-13769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T15:49:54Z",
    "nvd_published_at": "2026-07-01T19:16:36Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials.\u00a0\n\n### Impact\nOn Unix-like systems with a default umask, the following AWS CLI subcommands wrote credential or configuration files with world-readable permissions (0644) instead of owner-only (0600):\u00a0\n- aws codeartifact login\u00a0\n\n- aws iam create-virtual-mfa-device\u00a0\u00a0\n\n- aws deploy register\u00a0\n\nAny other local user on the same host could read these files and obtain the credentials.\u00a0\u00a0\n\nImpacted versions: \u003c=1.44.77 (v1) AND \u003c=2.34.28 (v2)\n\n### Patches\nThis issue has been addressed in AWS CLI v1 version 1.44.78 and AWS CLI v2 version 2.34.29. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\u00a0\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to\u00a0[aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "id": "GHSA-wfp6-f47h-hxc3",
  "modified": "2026-07-24T15:49:54Z",
  "published": "2026-07-24T15:49:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/security/advisories/GHSA-wfp6-f47h-hxc3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13769"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/pull/10191"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/pull/10194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/pull/10206"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/commit/68811b5ad5cd74d06e944e073ee17bf889babf13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/commit/84f0ec6afda03f8a26ff8dea403d02b1b31ee610"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/commit/e0799fde3c5e3138163e488e42bd3df7a0aa158f"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-049-aws"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aws/aws-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/releases/tag/1.44.78"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-cli/releases/tag/2.34.29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AWS CLI: Overly permissive File Permissions"
}

CVE-2026-13769 (GCVE-0-2026-13769)

Vulnerability from cvelistv5 – Published: 2026-07-01 18:34 – Updated: 2026-07-01 19:24

Title

Overly permissive File Permissions in AWS CLI

Summary

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

AMZN

References

4 references

URL	Tags
https://github.com/aws/aws-cli/releases/tag/1.44.78	patch
https://github.com/aws/aws-cli/releases/tag/2.34.29	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/aws/aws-cli/security/advisorie…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
AWS	AWS CLI	Affected: 0 , ≤ 1.44.77 (custom) Affected: 0 , ≤ 2.34.28 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T19:24:38.276341Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T19:24:53.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AWS CLI",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "1.44.77",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.34.28",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOverly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).\u003cbr\u003e\u003cbr\u003eTo remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.\u003c/p\u003e"
            }
          ],
          "value": "Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).\n\nTo remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-155",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-155: Screen Temporary Files for Sensitive Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T18:41:29.328Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/aws-cli/releases/tag/1.44.78"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/aws-cli/releases/tag/2.34.29"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-049-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/aws/aws-cli/security/advisories/GHSA-wfp6-f47h-hxc3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Overly permissive File Permissions in AWS CLI",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-13769",
    "datePublished": "2026-07-01T18:34:19.112Z",
    "dateReserved": "2026-06-29T20:24:05.617Z",
    "dateUpdated": "2026-07-01T19:24:53.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-WFP6-F47H-HXC3

Summary

Impact

Patches

CVE-2026-13769 (GCVE-0-2026-13769)

Tags

Sightings

Nomenclature