Key points
- AWS identified CVE-2026-107332 in the CodeCatalyst connection handler of its VS Code extension.
- Cached bearer tokens were saved with world-readable permissions and persisted after sessions ended.
- Users on versions prior to 4.10.0 are affected and should update immediately.
System administrators and security teams must address a newly disclosed vulnerability in the AWS Toolkit for Visual Studio Code that exposed sensitive authentication tokens to local attackers. The issue, tracked as CVE-2026-107332, stems from insecure default file permissions applied to cached credentials within the extension’s CodeCatalyst connection handler.
How it unfolded
- AWS published Security Bulletin 2026-129-AWS on October 8, 2026, classifying the issue as important and requiring attention.
- The vulnerability was identified in the open-source AWS Toolkit for Visual Studio Code, which facilitates developer interactions with AWS services, including Amazon CodeCatalyst.
- AWS confirmed that the flaw allowed local users or processes with file system access to read cached bearer tokens.
Who is affected
The vulnerability impacts any organization or individual using the AWS Toolkit for Visual Studio Code version 4.10.0 or earlier. The risk is specific to users who connect to Amazon CodeCatalyst Dev Environments through the extension.
According to the official AWS advisory, when a user established a connection to a CodeCatalyst Dev Environment, the extension cached the user’s CodeCatalyst bearer token to a local file. The critical failure occurred in two stages. First, the extension saved this file with world-readable permissions, meaning any user account or process on the same machine could read its contents. Second, the extension failed to remove the file after the session ended, leaving the token accessible long after the developer had disconnected.
A local attacker with basic file system access could read this persistent file and obtain the bearer token. This token grants access to the CodeCatalyst environment, potentially compromising code repositories, build pipelines, and other resources associated with that environment. The threat is strictly local; remote exploitation is not described in the advisory.
What happens next
AWS has released version 4.10.0 of the AWS Toolkit for Visual Studio Code, which resolves CVE-2026-107332. Users should update their extensions immediately.
For system administrators managing developer workstations, enforcing automatic updates for VS Code extensions is a recommended defensive step. Organizations should also audit local file permissions on developer machines to ensure that no other tools are caching credentials with overly permissive access rights. While this specific vulnerability is patched, the broader practice of verifying how development tools handle sensitive tokens remains a critical security hygiene task.
Frequently asked questions
What is CVE-2026-107332?
It is a vulnerability in the AWS Toolkit for Visual Studio Code where cached CodeCatalyst bearer tokens were saved with world-readable permissions and not deleted after use.
Which versions of the AWS Toolkit for Visual Studio Code are vulnerable?
All versions prior to 4.10.0 are affected by this security issue.
How can an attacker exploit this vulnerability?
A local user or process with access to the file system can read the cached token file to obtain the bearer token.
