Medium severity5.5NVD Advisory· Published Aug 11, 2026· Updated Sep 9, 2026
CVE-2026-48790
CVE-2026-48790
Description
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/tursodatabase/turso-cliGo | < 1.0.26 | 1.0.26 |
Affected products
3- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-57f6-pvx8-hwj6ghsaADVISORY
- github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6nvdWEB
- github.com/spf13/viper/blob/v1.21.0/viper.gonvd
- github.com/spf13/viper/blob/v1.21.0/viper.gonvd
- github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66nvd
News mentions
0No linked articles in our index yet.