Bug 2496161 (CVE-2026-13769) - CVE-2026-13769 aws-cli: AWS CLI: Information disclosure via overly permissive file permissions
Summary: CVE-2026-13769 aws-cli: AWS CLI: Information disclosure via overly permissive...
Keywords:
Status: NEW
Alias: CVE-2026-13769
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2497442 2497443
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-01 20:03 UTC by OSIDB Bzimport
Modified: 2026-07-06 19:41 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-01 20:03:28 UTC 
Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register).

To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.
Note You need to log in before you can comment on or make changes to this bug.