CVE-2026-48790
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Turso CLI before version 1.0.26 persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations.
Risk Assessment
A local attacker can steal the user's JWT and gain unauthorized access to the Turso platform, potentially leading to data breaches or unauthorized actions within the organization.
Recommendation
Update Turso CLI to version 1.0.26 or later, which fixes the issue, and ensure configuration files have appropriate permissions.
Original NVD description (English source)
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.