Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-01T18:34:19 aws-cli: AWS CLI: Information disclosure via overly permissive file permissions 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-277

Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

A flaw was found in AWS CLI. Overly permissive file permissions on Unix-like systems, where the umask has not been configured to restrict file permissions, may allow other local users on the same host to read credentials. This occurs when certain AWS CLI subcommands, such as aws codeartifact login, aws iam create-virtual-mfa-device, or aws deploy register, write credentials. This vulnerability can lead to information disclosure, potentially exposing sensitive user credentials to unauthorized local attackers.

Successful exploitation requires an attacker to already have local access to the same Unix-like host as the targeted user. Additionally, the vulnerability relies on the system having an unrestricted umask configuration and requires the victim to manually execute specific AWS CLI subcommands (such as codeartifact login or iam create-virtual-mfa-device) that write credentials to the filesystem. Impact Limitations: The direct impact is strictly limited to localized information disclosure. While the exposure of sensitive AWS credentials is a serious risk that could lead to the compromise of external AWS resources, the vulnerability itself does not allow an attacker to escalate privileges, achieve remote code execution, or compromise the integrity and availability of the local host system. To mitigate this issue, configure a more restrictive umask for users who execute AWS CLI subcommands that handle credentials. Setting a umask of `0077` or `0027` will prevent other local users from reading newly created files. This can be achieved by adding `umask 0077` (or `umask 0027`) to the user's shell profile (e.g., `~/.bashrc` or `~/.profile`). Users must log out and back in for the new umask to take effect. This mitigation applies to newly created files and does not affect existing files with overly permissive permissions. Red Hat Enterprise Linux 10 Fix deferred awscli2 Red Hat Enterprise Linux 9 Fix deferred awscli2 https://www.cve.org/CVERecord?id=CVE-2026-13769 https://nvd.nist.gov/vuln/detail/CVE-2026-13769 https://aws.amazon.com/security/security-bulletins/2026-049-aws/ https://github.com/aws/aws-cli/releases/tag/1.44.78 https://github.com/aws/aws-cli/releases/tag/2.34.29 https://github.com/aws/aws-cli/security/advisories/GHSA-wfp6-f47h-hxc3