{"id":"CVE-2026-89332","kind":"vulnerability","aliases":["CVE-2026-89332"],"related":[],"title":"Kiro IDE: agent-written workspace settings leak project data to outside URL","description":"CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration\n\n### CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration\n\nBulletin ID: 2026-111-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 12:00 PM PDT\n\nDescription:\n\nKiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents.\n\nWe identified CVE-2026-89332, where the Kiro agent could modify a workspace's settings file in an untrusted workspace in Kiro IDE. A specially crafted repository could use this to point the Kiro Powers registry URL, which Kiro fetches when the Powers panel is opened, at an external endpoint, sending potentially sensitive workspace data to that endpoint. Kiro presented the edit to the user for approval, showing the inserted data and the URL, but the file was already written to disk, so opening the Powers panel before responding to the prompt made the request anyway.\n\nImpacted versions: Kiro IDE < 0.8.135\n\nResolution:\n\nThis issue has been addressed in Kiro IDE version 0.8.135 and greater. We recommend upgrading to the latest version and rotate any credentials present in a project opened on an earlier version.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-89332\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"A specially crafted repository can make the Kiro agent write a workspace settings file that points the Powers registry URL at an external endpoint. When the Powers panel is opened, Kiro sends potentially sensitive workspace data to that endpoint, even if the user has not yet approved the edit.","severity":"medium","cvss":6.7,"epss":0.00179,"exploited":false,"exploited_at":null,"products":[{"name":"amazon kiro ide","fixed":["0.8.135"],"affected":"< 0.8.135","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","aws","developer-workstations","kiro-ide","lab-disclosure"],"not_affected_if":["no-kiro-ide","version-0.8.135-or-later"],"how_to_check":"- Check the installed Kiro IDE version and compare it with `0.8.135`.\n- Review workspace settings files in projects opened on earlier versions for an unexpected Powers registry URL.\n- unknown for any other check the sources provide.","fix":"- Upgrade Kiro IDE to `0.8.135` or later.\n- Rotate any credentials present in a project opened on an earlier version.","status":"open","published_at":"2026-09-11T20:19:23+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:30:01+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T05:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kiro IDE to `0.8.135` or later.\n- Rotate any credentials present in a project opened on an earlier version.","reach":"internet","title":"Kiro IDE: agent-written workspace settings leak project data to outside URL","impact":"medium","summary":"A specially crafted repository can make the Kiro agent write a workspace settings file that points the Powers registry URL at an external endpoint. When the Powers panel is opened, Kiro sends potentially sensitive workspace data to that endpoint, even if the user has not yet approved the edit.","category":"ai-tooling","nicknames":[],"who_cares":["kiro-ide","ai-agents","developer-workstations"],"confidence":0.8,"needs_auth":"no","worst_case":"Sensitive workspace data is sent to an attacker-controlled endpoint.","analyst_note":"","how_to_check":"- Check the installed Kiro IDE version and compare it with `0.8.135`.\n- Review workspace settings files in projects opened on earlier versions for an unexpected Powers registry URL.\n- unknown for any other check the sources provide.","needs_analyst":false,"not_affected_if":["version-0.8.135-or-later","no-kiro-ide"],"who_is_affected":"Teams using Kiro IDE before `0.8.135` who open untrusted or third-party repositories, since the agent can be induced to write the malicious settings. The exposure depends on opening the Powers panel in such a workspace. Teams already on `0.8.135` or later, or who do not use Kiro IDE, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":3891,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111':121C '-2026':15A,18A,89C,104C,165C,300C '-89332':16A,19A,90C,105C,166C,301C '0.8.135':262C,273C '00':134C '09/11/2026':132C '12':133C '2026':120C 'address':268C 'agent':4A,25B,47B,99C,114C,142C,161C,170C 'agent-written':3A,98C,113C 'ai':24B,27B,160C 'ai-ag':23B 'ai-tool':26B 'alreadi':240C 'amazon':20A 'anyway':257C 'approv':85B,228C 'attent':129C 'aw':29B,122C,124C 'aws-security@amazon.com':304C 'bulletin':118C 'concern':310C 'configur':102C,117C 'content':125C 'could':171C,189C 'craft':41B,187C 'credenti':286C 'cve':14A,17A,88C,103C,164C,299C 'data':10A,74B,95C,110C,216C,232C 'date':131C 'descript':137C 'develop':31B,143C,150C 'developer-workst':30B 'disclosur':38B 'disk':243C 'earlier':294C 'easi':148C 'edit':87B,223C 'email':303C 'endpoint':62B,77B,211C,219C 'engin':154C 'environ':144C 'even':78B 'exfiltr':96C,111C 'extern':61B,210C 'fetch':201C 'file':52B,177C,238C 'greater':275C 'help':158C 'id':119C 'ide':2A,22A,35B,92C,107C,139C,184C,261C,271C 'identifi':163C 'impact':258C 'import':127C 'insert':231C 'issu':265C 'kiro':1A,21A,34B,46B,69B,91C,106C,138C,169C,183C,195C,200C,220C,260C,270C 'kiro-id':33B 'lab':37B 'lab-disclosur':36B 'latest':281C 'leak':8A 'made':254C 'make':44B,146C 'modifi':172C 'none':297C 'open':68B,207C,245C,291C 'outsid':12A 'panel':66B,205C,248C 'pdt':136C 'pleas':302C 'pm':135C 'point':54B,193C 'potenti':71B,213C 'power':56B,65B,196C,204C,247C 'present':221C,287C 'project':9A,290C 'prompt':253C 'public':130C 'question':308C 'real':153C 'recommend':277C 'refer':298C 'registri':57B,197C 'repositori':42B,188C 'request':256C 'requir':128C 'resolut':263C 'respond':250C 'rotat':284C 'scope':123C 'secur':307C 'send':70B,212C 'sensit':72B,93C,108C,214C 'set':7A,51B,176C 'ship':152C 'show':229C 'special':40B,186C 'tool':28B 'type':126C 'untrust':180C 'upgrad':278C 'url':13A,58B,198C,235C 'use':190C 'user':81B,226C 'version':259C,272C,282C,295C 'via':97C,112C 'work':155C 'workaround':296C 'workspac':6A,50B,73B,94C,101C,109C,116C,174C,181C,215C 'workstat':32B 'write':48B 'written':5A,100C,115C,241C 'yet':84B","nicknames":[],"mitigations":[],"who_affected":"Teams using Kiro IDE before `0.8.135` who open untrusted or third-party repositories, since the agent can be induced to write the malicious settings. The exposure depends on opening the Powers panel in such a workspace. Teams already on `0.8.135` or later, or who do not use Kiro IDE, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-11T20:19:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/#CVE-2026-89332","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration"},{"source":"nvd","external_id":"CVE-2026-89332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89332","severity":null,"published_at":"2026-09-11T20:19:23+00:00","modified_at":"2026-09-16T13:49:23+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89332","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89332","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2881,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/","title":"AWS: CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration","kind":"advisory","source":"lab","text":"CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration\n\n### CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration\n\nBulletin ID: 2026-111-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 12:00 PM PDT\n\nDescription:\n\nKiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents.\n\nWe identified CVE-2026-89332, where the Kiro agent could modify a workspace's settings file in an untrusted workspace in Kiro IDE. A specially crafted repository could use this to point the Kiro Powers registry URL, which Kiro fetches when the Powers panel is opened, at an external endpoint, sending potentially sensitive workspace data to that endpoint. Kiro presented the edit to the user for approval, showing the inserted data and the URL, but the file was already written to disk, so opening the Powers panel before responding to the prompt made the request anyway.\n\nImpacted versions: Kiro IDE < 0.8.135\n\nResolution:\n\nThis issue has been addressed in Kiro IDE version 0.8.135 and greater. We recommend upgrading to the latest version and rotate any credentials present in a project opened on an earlier version.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-89332\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}