CVE-2026-95835

What it is

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the escape code, parses a prompt definition out of it, and writes the user's answer back into an object of that same name, without at any point checking that the object is owned by the user running kitty or that its permissions exclude other users. The equivalent consumer of the same SharedMemory class in the ssh kitten performs exactly that check; the askpass path did not. The handler is reached through a device control string processed from the byte stream of the window, so the attacker must also cause bytes of their choosing to be displayed by the victim's terminal. Where the POSIX shared memory namespace is shared between the two users, a second local user can create an object with permissions that allow the victim to read and write it, cause the victim's kitty to render a prompt of the attacker's choosing, including a masked password prompt, and read the typed secret back out of the object afterwards. The prompt text is additionally passed to the display without control character sanitisation, so it can overwrite the warning line kitty prints above it. The answer is written by reopening an object of that name when the user answers, rather than through the handle already held. This results in disclosure of a secret typed by the victim to a second local user, and does not require any privilege on the victim's account.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. High risk of data exposure.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-25 17:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-29 21:32 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.1% in the next 30 days (EPSS).
• Severity: 5.6 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2026-09-25 17:17 UTC

Last modified

2026-09-29 21:32 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 5.6

Attack vector

Local

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

Active

Confidentiality

High

Integrity

Low

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-95835.md and follow it. Check whether this project is affected by CVE-2026-95835. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge