Description
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
Published: 2026-08-11
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Turso CLI writes the platform JSON Web Token to a settings.json file using Viper with default permissions of 0o644, allowing any local user to read the credential. This exposes a token that grants the holder full access to the Turso platform for their organizations, effectively leaking confidential authentication information.

Affected Systems

The flaw appears in tursodatabase's turso-cli prior to release 1.0.26. Any installation on Linux or macOS that persists the token locally uses the insecure file permissions, and the affected component is the Viper configuration handling within the CLI.

Risk and Exploitability

The CVSS base score of 5.5 indicates moderate severity. The EPSS score of <1% suggests low likelihood of exploitation. Since the token is stored locally, the attack vector is local, requiring an attacker to have a user account on the same host. The token grants full platform access, but the overall impact is limited to systems with the vulnerable CLI installed. The issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 12, 2026 at 20:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to turso-cli version 1.0.26 or later
  • If upgrading is not immediately possible, change the permissions of the settings.json file to 600 to restrict access to the owning user
  • Remove the stored JWT from the file or supply the token via an environment variable to avoid persistent storage

Generated by OpenCVE AI on August 12, 2026 at 20:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-57f6-pvx8-hwj6 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Tursodatabase
Tursodatabase turso-cli
Vendors & Products Tursodatabase
Tursodatabase turso-cli

Wed, 12 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
Title turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Weaknesses CWE-276
CWE-732
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Tursodatabase Turso-cli
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-12T22:13:40.373Z

Reserved: 2026-05-22T20:18:20.366Z

Link: CVE-2026-48790

cve-icon Vulnrichment

Updated: 2026-08-12T22:07:50.613Z

cve-icon NVD

Status : Received

Published: 2026-08-11T18:17:34.167

Modified: 2026-08-12T23:17:21.250

Link: CVE-2026-48790

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:50:31Z

Weaknesses
  • CWE-276

    Incorrect Default Permissions

  • CWE-732

    Incorrect Permission Assignment for Critical Resource