The vulnerability arises from overly permissive file permissions set by the AWS Command Line Interface on Unix‑like operating systems when the default umask is not restrictive, constituting a CWE‑277 (Least Privilege) and CWE‑732 (Access Control) weakness. Certain CLI subcommands write AWS credential files that become world‑readable, enabling any local user on the same host to read credentials that were intended to remain confidential. This poses a credential compromise risk on systems with multiple local users or shared environments, requiring no network access from the attacker.

Affected installations are AWS CLI versions earlier than 1.44.78 (v1) and earlier than 2.34.29 (v2) running on Unix‑like operating systems. The flaw does not exist in environments where the umask is set to restrict file permissions (e.g., umask 077) before executing credential‑writing commands.

The CVSS score of 6.8 places the flaw in the medium severity range. The EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is local; any local user who can read files on the host can retrieve exposed credentials, making exploitation straightforward in multi‑user or shared‑system scenarios.