Executive brief
AWS CLI is a command-line tool used by developers and operators to manage AWS cloud resources and services. The vulnerability allows a local attacker on a shared system to read AWS credentials and configuration files due to insecure file permissions, potentially granting them unauthorized access to AWS accounts and resources. This is particularly critical in shared hosting environments, development machines, and systems where multiple users have access.
Technical details
The vulnerability is a file permissions misconfiguration in AWS CLI where credential and configuration files are created with overly permissive permissions (likely world-readable or group-readable). An attacker with local file system access can directly read these files to extract AWS access keys and configuration details. The attack vector is local; no network access is required, but the attacker must have access to the same system where AWS CLI is configured. This enables credential theft and subsequent unauthorized API access to AWS services under the compromised identity. Patch availability should be confirmed via AWS security bulletins.
Affected products
- AWS AWS CLI
Timeline
- 2026-09-22: disclosed