CVE-2026-48790

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-11 18:17

Updated : 2026-09-09 20:46

NVD link : CVE-2026-48790

Mitre link : CVE-2026-48790

CVE.ORG link : CVE-2026-48790

JSON object : View

Products Affected

No product.

CWE

CWE-276

Incorrect Default Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-48790", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48790", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T22:07:49.576700Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tursodatabase", "product": "turso-cli", "versions": [{"status": "affected", "version": "< 1.0.26"}]}]}], "published": "2026-08-11T18:17:34.167", "references": [{"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688", "source": "security-advisories@github.com"}, {"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198", "source": "security-advisories@github.com"}, {"url": "https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66", "source": "security-advisories@github.com"}, {"url": "https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue."}], "lastModified": "2026-09-09T20:46:02.457", "sourceIdentifier": "security-advisories@github.com"}