CVE-2026-48790

Name of the Vulnerable Software and Affected Versions turso-cli (affected versions not specified)

Description the turso-cli tool stores the user's platform JSON Web Token (JWT) in a settings.json file using default file permissions of 0o644. This configuration makes the credential file world-readable on standard Linux and macOS systems, allowing any local user on the host to read the file and recover the JWT. An attacker with this token gains full access to the Turso platform for any organization the user belongs to, enabling actions such as creating or destroying databases, rotating credentials, exfiltrating data, and modifying billing settings.

The issue occurs because the SetToken() function writes the token via the Viper library, which defaults to 0o644 permissions unless SetConfigPermissions(0o600) is explicitly called. The affected file is located at ~/.config/turso/settings.json on Linux and ~/Library/Application Support/turso/settings.json on macOS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, manually restrict the permissions of the settings file and its directory by running chmod 600 ~/.config/turso/settings.json and chmod 700 ~/.config/turso on Linux, or chmod 600 "$HOME/Library/Application Support/turso/settings.json" and chmod 700 "$HOME/Library/Application Support/turso" on macOS.