CVE-2026-13769: AWS CLI: Overly permissive File Permissions
The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host to read credentials.
References
- aws.amazon.com/security/security-bulletins/2026-049-aws
- github.com/advisories/GHSA-wfp6-f47h-hxc3
- github.com/aws/aws-cli/commit/68811b5ad5cd74d06e944e073ee17bf889babf13
- github.com/aws/aws-cli/commit/84f0ec6afda03f8a26ff8dea403d02b1b31ee610
- github.com/aws/aws-cli/commit/e0799fde3c5e3138163e488e42bd3df7a0aa158f
- github.com/aws/aws-cli/pull/10191
- github.com/aws/aws-cli/pull/10194
- github.com/aws/aws-cli/pull/10206
- github.com/aws/aws-cli/releases/tag/1.44.78
- github.com/aws/aws-cli/releases/tag/2.34.29
- github.com/aws/aws-cli/security/advisories/GHSA-wfp6-f47h-hxc3
- nvd.nist.gov/vuln/detail/CVE-2026-13769
Code Behaviors & Features
Detect and mitigate CVE-2026-13769 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →