CVE-2026-89332: repo content hijacks Powers

CISO Take

A flaw in Amazon Kiro IDE's "Kiro Powers" feature lets untrusted repository content manipulate the coding agent into rewriting the workspace settings file, silently redirecting the Powers registry endpoint to an attacker-controlled server; simply opening the Powers panel afterward then sends workspace data — potentially including credentials — to that server. This is a local, unauthenticated, low-complexity attack (CVSS 3.1, AV:L/AC:L/UI:R) that only requires a developer to open a malicious or compromised repository and later interact with the Powers panel, with no EPSS or CISA KEV data yet since it was published 2026-09-11 and remains unweaponized in public exploit trackers. The confidentiality-only impact (C:H/I:N/A:N) reflects a real risk for organizations using AI coding assistants on third-party or open-source repos, where the developer workstation itself becomes the exfiltration target. Upgrade Kiro IDE to 0.8.135 or later immediately, and for any project opened in an earlier version, rotate all credentials that were present in that workspace as AWS explicitly recommends. Until patched, treat unreviewed repository content opened in Kiro as untrusted input capable of altering local configuration.

Sources: NVD ATLAS

What is the risk?

Medium overall risk (CVSS 5.5) driven by high confidentiality impact but constrained by required user interaction and local attack vector. No public exploit code, no Nuclei template, and no CISA KEV listing exist as of this analysis, and EPSS data is unavailable, suggesting exploitation is currently theoretical rather than active. However, the attack chain is low-complexity and needs no authentication — a developer merely opening a booby-trapped repository in Kiro IDE and later using the Powers panel is sufficient. The risk profile is elevated by the fact that developer workstations routinely hold cloud credentials, API keys, and source code, making even a narrow confidentiality-only bug high-value for attackers targeting the software supply chain.

How does the attack unfold?

Malicious repository delivery

Attacker crafts repository content designed to influence the Kiro coding agent's behavior and gets a developer to open it in Kiro IDE.

AML.T0051.001

Agentic configuration tampering

The agent, processing the untrusted content, modifies the workspace settings file to redirect the Kiro Powers registry endpoint to an attacker-controlled server.

AML.T0081

Trigger via normal usage

The developer opens the Kiro Powers panel as part of routine workflow, unknowingly firing the tampered registry request.

Data exfiltration

Workspace data, potentially including credentials, is sent to the attacker-controlled endpoint instead of the legitimate registry.

AML.T0025

Malicious repository delivery

Attacker crafts repository content designed to influence the Kiro coding agent's behavior and gets a developer to open it in Kiro IDE.

AML.T0051.001

Agentic configuration tampering

The agent, processing the untrusted content, modifies the workspace settings file to redirect the Kiro Powers registry endpoint to an attacker-controlled server.

AML.T0081

Trigger via normal usage

The developer opens the Kiro Powers panel as part of routine workflow, unknowingly firing the tampered registry request.

Data exfiltration

Workspace data, potentially including credentials, is sent to the attacker-controlled endpoint instead of the legitimate registry.

AML.T0025

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade Amazon Kiro IDE to version 0.8.135 or later immediately — this is the vendor-confirmed fix. For any workspace that was opened in an earlier vulnerable version, rotate all credentials and secrets that were present in that project (API keys, cloud credentials, tokens), per AWS's explicit guidance. As a workaround/detection measure, audit workspace settings files for unexpected changes to the Kiro Powers registry endpoint URL, and monitor outbound network connections from developer workstations to unfamiliar domains when the Powers panel is used. Treat cloning or opening unreviewed/third-party repositories in Kiro (or any agentic IDE) as a trust boundary — review repository contents before opening them in an agent-enabled editor, and consider restricting Powers/plugin-registry features until patched.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Supply Chain Code Execution Agent Plugin AML.T0025 - Exfiltration via Cyber Means AML.T0051.001 - Indirect AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operational monitoring

NIST AI RMF

MANAGE-2.3 - Third-party AI system risks are managed

OWASP LLM Top 10

LLM01 - Prompt Injection LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-89332?

A flaw in Amazon Kiro IDE's "Kiro Powers" feature lets untrusted repository content manipulate the coding agent into rewriting the workspace settings file, silently redirecting the Powers registry endpoint to an attacker-controlled server; simply opening the Powers panel afterward then sends workspace data — potentially including credentials — to that server. This is a local, unauthenticated, low-complexity attack (CVSS 3.1, AV:L/AC:L/UI:R) that only requires a developer to open a malicious or compromised repository and later interact with the Powers panel, with no EPSS or CISA KEV data yet since it was published 2026-09-11 and remains unweaponized in public exploit trackers. The confidentiality-only impact (C:H/I:N/A:N) reflects a real risk for organizations using AI coding assistants on third-party or open-source repos, where the developer workstation itself becomes the exfiltration target. Upgrade Kiro IDE to 0.8.135 or later immediately, and for any project opened in an earlier version, rotate all credentials that were present in that workspace as AWS explicitly recommends. Until patched, treat unreviewed repository content opened in Kiro as untrusted input capable of altering local configuration.

Is CVE-2026-89332 actively exploited?

No confirmed active exploitation of CVE-2026-89332 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-89332?

Upgrade Amazon Kiro IDE to version 0.8.135 or later immediately — this is the vendor-confirmed fix. For any workspace that was opened in an earlier vulnerable version, rotate all credentials and secrets that were present in that project (API keys, cloud credentials, tokens), per AWS's explicit guidance. As a workaround/detection measure, audit workspace settings files for unexpected changes to the Kiro Powers registry endpoint URL, and monitor outbound network connections from developer workstations to unfamiliar domains when the Powers panel is used. Treat cloning or opening unreviewed/third-party repositories in Kiro (or any agentic IDE) as a trust boundary — review repository contents before opening them in an agent-enabled editor, and consider restricting Powers/plugin-registry features until patched.

What systems are affected by CVE-2026-89332?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer tooling / IDE plugins, AI coding assistants.

What is the CVSS score for CVE-2026-89332?

CVE-2026-89332 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdeveloper tooling / IDE pluginsAI coding assistants

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0051.001 Indirect

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.

Exploitation Scenario

An attacker publishes or contributes to a seemingly benign public repository (e.g., an open-source library, a CTF challenge, or a fake fork) containing crafted content designed to be parsed by Kiro's coding agent. A developer clones and opens this repository in a vulnerable Kiro IDE version. The agent, processing the untrusted repo content, is induced to modify the workspace settings file so that the Kiro Powers registry endpoint now points to an attacker-controlled server. The developer, unaware of the change, later opens the Powers panel as part of normal workflow — at which point Kiro sends workspace data (potentially including embedded secrets, file paths, or project metadata) to the attacker's endpoint instead of the legitimate Amazon registry, achieving silent data exfiltration with no further user action required.

Weaknesses (CWE)

CWE-201 Insertion of Sensitive Information Into Sent Data CWE-201 Insertion of Sensitive Information Into Sent Data CWE-829 Inclusion of Functionality from Untrusted Control Sphere CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-201 — Insertion of Sensitive Information Into Sent Data: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

[Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
[Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

Source: MITRE CWE corpus.