CVE-2026-48790

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Turso CLI es la interfaz de línea de comandos (CLI) para la base de datos de código abierto Turso. Las versiones anteriores a la 1.0.26 persisten el JWT de la plataforma Turso del usuario en ’settings.json’ usando los ’configPermissions’ predeterminados de Viper de ’0o644’, dejando el archivo de credenciales legible para todos en sistemas Linux y macOS estándar. Cualquier otro UID local en el host puede leer el archivo y recuperar el JWT de la plataforma, lo que otorga acceso completo a la plataforma Turso con alcance a las organizaciones del usuario. La versión 1.0.26 corrige el problema.

Information

Published : 2026-08-11 18:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-48790

Mitre link : CVE-2026-48790

CVE.ORG link : CVE-2026-48790

JSON object : View

Products Affected

No product.

CWE

CWE-276

Incorrect Default Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-48790", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48790", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T22:07:49.576700Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tursodatabase", "product": "turso-cli", "versions": [{"status": "affected", "version": "< 1.0.26"}]}]}], "published": "2026-08-11T18:17:34.167", "references": [{"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688", "source": "security-advisories@github.com"}, {"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198", "source": "security-advisories@github.com"}, {"url": "https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66", "source": "security-advisories@github.com"}, {"url": "https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue."}, {"lang": "es", "value": "Turso CLI es la interfaz de l\u00ednea de comandos (CLI) para la base de datos de c\u00f3digo abierto Turso. Las versiones anteriores a la 1.0.26 persisten el JWT de la plataforma Turso del usuario en \u2019settings.json\u2019 usando los \u2019configPermissions\u2019 predeterminados de Viper de \u20190o644\u2019, dejando el archivo de credenciales legible para todos en sistemas Linux y macOS est\u00e1ndar. Cualquier otro UID local en el host puede leer el archivo y recuperar el JWT de la plataforma, lo que otorga acceso completo a la plataforma Turso con alcance a las organizaciones del usuario. La versi\u00f3n 1.0.26 corrige el problema."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "security-advisories@github.com"}