CVE-2026-48790Medium· 5.5▾ SunlitTurso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credenti…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.1%
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/tursodatabase/turso-cli <= 1.0.25Patched in:
github.com/tursodatabase/turso-cli 1.0.26Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115253High· 7.3WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
CVE-2026-78553NoneRansomLook created its Flask session-signing key without explicitly restricting the file permissions
CVE-2025-54546High· 7.5On affected platforms, restricted users could use SSH port forwarding to access host-internal services
CVE-2025-54545High· 7.8On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
CVE-2025-43470Medium· 5.5A permissions issue was addressed with additional restrictions
CVE-2025-61970NoneWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking.