CVE-2026-89332 in Kiro IDE
Summary
by MITRE • 09/11/2026
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened.
To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified within Amazon Kiro IDE prior to version 0.8.135 represents a critical failure in input validation and trust boundary enforcement, specifically categorized under CWE-20 as Improper Input Validation combined with CWE-94 as Code Injection via Untrusted Control Sphere. This flaw allows remote unauthenticated actors to exploit the integration of functionality from external sources without adequate sanitization or verification mechanisms. The core technical issue lies in how the Kiro Powers feature processes repository content, failing to distinguish between trusted internal configurations and maliciously crafted external inputs. When a developer opens a project containing specially constructed repository data, the IDE agent incorrectly interprets this content as valid configuration instructions rather than potential threats. This misinterpretation leads to an unauthorized modification of local workspace settings files, effectively hijacking the normal operational flow of the application by redirecting sensitive registry requests away from secure endpoints toward attacker-controlled domains.
From a technical perspective, the exploitation mechanism relies on the agent's tendency to automatically apply changes derived from repository content upon opening a project. By manipulating these contents, an adversary can inject directives that alter the network configuration used by the Kiro Powers panel. Once this redirection is established, any subsequent interaction with the Powers panel triggers data exfiltration events. Specifically, when the user opens the Powers interface, the application sends workspace-specific data to the malicious endpoint controlled by the remote actor. This process bypasses standard authentication protocols because the vulnerability operates at the configuration layer before network requests are initiated, allowing unauthenticated access to sensitive developer workstation information. The attack vector is effectively classified under MITRE ATT&CK technique T1059 as Command and Scripting Interpreter abuse, where the attacker uses the IDE's own functionality to execute unauthorized actions that facilitate data theft.
The operational impact of this vulnerability extends beyond simple data leakage, posing significant risks to intellectual property and developer security posture. Sensitive information from a developer workstation can include proprietary code snippets, internal API keys, configuration secrets, or other contextual project details stored within the workspace settings. Since the attack requires only that the user opens a maliciously crafted repository, it constitutes a high-risk social engineering vector where developers may inadvertently compromise their systems by pulling down compromised open-source projects or collaborating with untrusted parties. The ability to redirect registry requests also implies potential for further exploitation chains, such as man-in-the-middle attacks if the attacker controls the destination endpoint and can intercept subsequent communications intended for legitimate services.
To mitigate this risk, immediate action is required from all users operating versions of Amazon Kiro IDE earlier than 0.8.135. The primary remediation step involves upgrading to version 0.8.135 or later, which includes patches that enforce stricter validation on repository content and prevent unauthorized modifications to workspace settings files. For organizations where developers have already opened projects in vulnerable versions, it is imperative to conduct a thorough audit of affected workstations. This should include rotating any credentials, API keys, or tokens that were present within the compromised project directories during the period of exposure. Additionally, implementing network monitoring solutions to detect anomalous outbound connections from development environments can provide an additional layer of defense against similar future incidents involving untrusted control sphere inclusions.