MEDIUM 6.8 NVD
CVE-2026-107332
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer toke
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
References
- https://aws.amazon.com/security/security-bulletins/2026-129-aws/
- https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0
- https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-9g5j-qgqm-857j
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-08 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.