CVE-2026-48790 tursodatabase CVE debrief

Who should care

Defenders responsible for systems using Turso CLI should assess exposure and prioritize remediation. This includes checking for any local UIDs on the host that could potentially read the `settings.json` file and ensuring that systems have been updated to version 1.0.26 or later.

Why it matters

CVE-2026-48790 is a vulnerability in Turso CLI that allows local users to gain full Turso platform access. Defenders should assess exposure, verify Turso CLI versions, and prioritize remediation to prevent unauthorized access.

• Local users can gain full Turso platform access scoped to the user's organizations
• Defenders must verify Turso CLI versions and update to 1.0.26 or later
• Exposure assessment requires checking for local UIDs that could read the `settings.json` file

Technical summary

The Turso CLI vulnerability (CVE-2026-48790) arises from the insecure persistence of Turso platform JWT credentials in a world-readable file, `settings.json`, on Linux and macOS systems. This issue allows any local user to read the file and gain full access to the Turso platform scoped to the user's organizations. The vulnerability was patched in version 1.0.26. Affected systems should be updated to prevent unauthorized access. Defenders should assess exposure by checking for any local UIDs on the host that could potentially read the `settings.json` file.

Defensive priority

Defenders should prioritize verifying Turso CLI versions and ensuring that systems using Turso CLI have been updated to version 1.0.26 or later. Additionally, defenders should assess exposure by checking for any local UIDs on the host that could potentially read the `settings.json` file.

Recommended defensive actions

• Verify Turso CLI versions and update to 1.0.26 or later
• Check for local UIDs that could read the `settings.json` file
• Assess exposure and prioritize remediation for affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. The CVE Program and NVD are official sources for this information. CVE-2026-48790 was patched in version 1.0.26. Evidence is limited to CVE and NVD details. Defenders should verify Turso CLI versions and check for local UIDs that could read the `settings.json` file.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.