Executive brief
The Turso command-line tool, used for managing cloud databases, stores sensitive login tokens in a file that is readable by any user on the same computer. This allows other people or malicious programs on a shared system to steal the user's credentials and gain full control over their databases, including the ability to delete data or change billing settings. Users should update to the latest version to ensure these credentials are saved with restricted permissions.
Technical details
The turso-cli utility uses the Viper configuration library to persist user authentication tokens to a settings.json file. By default, Viper creates files with 0o644 (world-readable) permissions unless explicitly configured otherwise. Because turso-cli did not call SetConfigPermissions(0o600), the resulting file on Linux and macOS allows any local user or process to read the plaintext JWT. An attacker with local access can use this token to perform administrative actions on the Turso platform, such as exfiltrating data or destroying databases. The issue is fixed in version 1.0.26 by explicitly setting restrictive file permissions.
Affected products
- Turso turso-cli <= 1.0.25
Timeline
- 2026-05-23: disclosed
- 2026-06-26: advisory: GitHub Advisory published