CVE-2026-48790 (GCVE-0-2026-48790)
Vulnerability from cvelistv5
Published
2026-08-11 17:25
Modified
2026-08-12 22:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| tursodatabase | turso-cli |
Version: < 1.0.26 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48790",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T22:07:49.576700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T22:13:40.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "turso-cli",
"vendor": "tursodatabase",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user\u0027s Turso platform JWT to `settings.json` using Viper\u0027s default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user\u0027s organizations. Version 1.0.26 patches the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:25:27.457Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6"
},
{
"name": "https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66"
},
{
"name": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688"
},
{
"name": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198"
}
],
"source": {
"advisory": "GHSA-57f6-pvx8-hwj6",
"discovery": "UNKNOWN"
},
"title": "turso-cli persists Turso platform JWT with world-readable (0o644) file permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48790",
"datePublished": "2026-08-11T17:25:27.457Z",
"dateReserved": "2026-05-22T20:18:20.366Z",
"dateUpdated": "2026-08-12T22:13:40.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48790\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-12T22:07:49.576700Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-12T22:07:50.613Z\"}}], \"cna\": {\"title\": \"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions\", \"source\": {\"advisory\": \"GHSA-57f6-pvx8-hwj6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"tursodatabase\", \"product\": \"turso-cli\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.0.26\"}]}], \"references\": [{\"url\": \"https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6\", \"name\": \"https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66\", \"name\": \"https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688\", \"name\": \"https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198\", \"name\": \"https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user\u0027s Turso platform JWT to `settings.json` using Viper\u0027s default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user\u0027s organizations. Version 1.0.26 patches the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276: Incorrect Default Permissions\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732: Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-11T17:25:27.457Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-48790\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T22:13:40.373Z\", \"dateReserved\": \"2026-05-22T20:18:20.366Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-11T17:25:27.457Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…