Missing Authentication for Critical Function in kitty - #VU164396
Published: November 10, 2026
Vulnerability identifier: #VU164396
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-306
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read or overwrite local files without transfer confirmation and execute arbitrary code on the system running kitty.
The vulnerability exists due to missing authentication in check_bypass() in kitty/file_transmission.py when the kitty-1 protocol accepts an empty password without checking whether file_transfer_confirmation_bypass is configured. A remote attacker can induce a user to establish an active malicious connection that receives $KITTY_PUBLIC_KEY, then initiate unauthorized file transfers to disclose files or overwrite shell startup or kitty configuration files to execute arbitrary code.
Affected software
kitty
Remediation
Install security update from vendor's website.
kitty - update to 0.49.2