CVE-2026-89332

MEDIUM 5.5

Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.

CWE	CWE-829 CWE-201
Vendor	aws
Product	kiro ide
Published	Sep 11, 2026
Last Updated	Sep 11, 2026

Stay Ahead of the Next One

Get instant alerts for aws kiro ide

Be the first to know when new medium vulnerabilities affecting aws kiro ide are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

AWS / Kiro IDE

0 < 0.8.135

References

NVD ↗ CVE.org ↗ EPSS Data ↗

kiro.dev: https://kiro.dev/changelog/ide/0-8/#patch-0-8-135 aws.amazon.com: https://aws.amazon.com/security/security-bulletins/2026-111-aws/