CVE-2026-13769

A flaw was found in AWS CLI. Overly permissive file permissions on Unix-like systems, where the umask has not been configured to restrict file permissions, may allow other local users on the same host to read credentials. This occurs when certain AWS CLI subcommands, such as aws codeartifact login, aws iam create-virtual-mfa-device, or aws deploy register, write credentials. This vulnerability can lead to information disclosure, potentially exposing sensitive user credentials to unauthorized local attackers.

Successful exploitation requires an attacker to already have local access to the same Unix-like host as the targeted user. Additionally, the vulnerability relies on the system having an unrestricted umask configuration and requires the victim to manually execute specific AWS CLI subcommands (such as codeartifact login or iam create-virtual-mfa-device) that write credentials to the filesystem.

Impact Limitations: The direct impact is strictly limited to localized information disclosure. While the exposure of sensitive AWS credentials is a serious risk that could lead to the compromise of external AWS resources, the vulnerability itself does not allow an attacker to escalate privileges, achieve remote code execution, or compromise the integrity and availability of the local host system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure a more restrictive umask for users who execute AWS CLI subcommands that handle credentials. Setting a umask of 0077 or 0027 will prevent other local users from reading newly created files. This can be achieved by adding umask 0077 (or umask 0027) to the user's shell profile (e.g., ~/.bashrc or ~/.profile). Users must log out and back in for the new umask to take effect. This mitigation applies to newly created files and does not affect existing files with overly permissive permissions.