Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-48790turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Medium 5.5

In plain English

A medium-severity incorrect default permissions in turso-cli from tursodatabase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 95.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tursodatabase/turso-cli	1.0.26	GHSA-57f6-pvx8-hwj6
Go	github.com/tursodatabase/turso-cli	1.0.26	GO-2026-5811

Affected products (as reported)

Vendor	Product	Versions
tursodatabase	turso-cli	< 1.0.26

Weakness: CWE-276, CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6 x_refsource_CONFIRM
https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66 x_refsource_MISC
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688 x_refsource_MISC
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198 x_refsource_MISC