AWS disclosed a Kiro IDE vulnerability on September 11, 2026, that could let a specially crafted repository redirect a Kiro Powers registry request and send potentially sensitive workspace data to an attacker-controlled endpoint. The flaw is tracked as CVE-2026-89332 and affects Kiro IDE versions earlier than 0.8.135.
The fix is available, and the immediate action is simple: update Kiro IDE to version 0.8.135 or later. The response may require more than patching, however. AWS recommends rotating credentials that were present in any project opened with an affected version. This guide explains the risk without overstating it, then provides a practical update and incident-response checklist.
What should Kiro IDE users do about CVE-2026-89332?
Kiro IDE users should update to version 0.8.135 or later. If you opened a project with an older version, identify credentials accessible in that workspace and rotate them. Do not rely on a workaround: AWS lists none. Teams should also review repository trust, outbound network logs, and secret-management practices before reopening untrusted projects.
What is CVE-2026-89332?
CVE-2026-89332 is a Kiro IDE information-exposure vulnerability involving agent-written workspace configuration. According to the AWS advisory and CVE record, malicious content in a repository could cause the Kiro agent to modify a workspace settings file. That change could redirect the registry URL used by Kiro Powers to an external endpoint controlled by an attacker.
The dangerous sequence depends on user interaction. Kiro displayed the proposed edit for approval, but the file had already been written to disk. If the user opened the Powers panel before responding to that approval prompt, Kiro could make the redirected request and send workspace data to the external endpoint.
The CVE record classifies the issue under CWE-829, inclusion of functionality from an untrusted control sphere, and CWE-201, insertion of sensitive information into sent data. It assigns a CVSS 3.1 score of 5.5 and a CVSS 4.0 score of 6.7; both are Medium severity. Medium does not mean harmless. Developer workspaces can contain tokens, connection strings, configuration details, source code, or other information with significant operational value.
Which versions are affected?
- Affected: Kiro IDE versions earlier than 0.8.135.
- Fixed: Kiro IDE 0.8.135 and later.
- Workaround: None listed by AWS.
Check the version shown in Kiro IDE before opening another unfamiliar repository. If an automatic update is pending, complete it and restart the application. Then verify the installed version again rather than assuming the update finished successfully.
How the attack path works
- A repository contains crafted content. The vulnerable behavior begins after a user opens or works with an untrusted project in an affected Kiro version.
- The agent proposes a workspace-settings edit. The change points the Kiro Powers registry URL to an external endpoint.
- The settings reach disk before approval. Although Kiro shows the edit for review, the underlying file has already changed.
- The user opens the Powers panel. This action can trigger a request to the redirected endpoint before the user accepts or rejects the proposed edit.
- Workspace data may leave the machine. The endpoint may receive potentially sensitive information included in that request.
This is an important approval-design lesson for agentic software. A visible confirmation dialog is not a complete security boundary if the consequential state change occurs before approval. Applications should stage proposed changes separately and make them active only after a user approves them.
Step-by-step remediation checklist
1. Update Kiro IDE
Install Kiro IDE 0.8.135 or a newer release from the official update channel. Restart the application, confirm the new version, and make sure managed developer machines are not pinned to an older package.
2. Identify projects opened with an affected version
Build a list of repositories opened while Kiro was below 0.8.135, especially projects obtained from unknown contributors, public forks, coding exercises, archives, or unsolicited links. Include disposable tests: a short-lived clone can still expose credentials available to the process or workspace.
3. Inventory credentials that may have been accessible
Review environment files, development configuration, package-manager credentials, cloud profiles, source-control tokens, database URLs, signing material, and local tool configuration associated with each project. Do not copy secrets into a shared incident ticket. Record only the credential type, owner, scope, and rotation status.
4. Rotate exposed or potentially exposed credentials
AWS specifically recommends rotating credentials present in projects opened with earlier versions. Prioritize credentials with write access, production reach, broad cloud permissions, or long lifetimes. Revoke the old value, issue a replacement, update approved secret stores, and verify that the retired credential no longer works. ToolNexa’s guide to strong and unique credentials provides a useful foundation for personal accounts, but developer tokens should also be short-lived and narrowly scoped wherever possible.
5. Review settings and network evidence
Inspect workspace settings for unexpected registry URLs or other unexplained changes. If your organization records DNS, proxy, endpoint, or firewall activity, search for outbound connections from Kiro to unfamiliar domains around the time affected projects were used. Preserve relevant evidence before cleaning a workspace if the review finds suspicious activity.
6. Re-clone untrusted repositories safely
After patching, consider deleting only disposable local clones through your normal recovery process and obtaining a clean copy from a verified source. Review repository instructions and workspace configuration before enabling agent actions, extensions, tasks, hooks, or external tool connections.
How teams can reduce similar AI coding-tool risks
- Treat repositories as active content. A repository can influence tools through configuration, task files, hooks, prompts, and extension recommendations; it is not merely passive source code.
- Keep secrets outside project directories. Use an approved secret manager and inject short-lived values only when a task requires them.
- Use separate development identities. Avoid exposing administrator or production credentials to an AI-assisted IDE.
- Restrict outbound traffic where practical. Domain allowlists and monitored egress can limit or reveal unexpected callbacks.
- Require approval before persistence. Agent products should not make a proposed change effective before the user confirms it.
- Test the rejection path. Security reviews should verify that rejecting an agent action leaves no file, setting, process, or network side effect behind.
Is CVE-2026-89332 being actively exploited?
The CVE record available on September 12 says exploitation is not known. That is not proof that no exploitation has occurred; it means the cited authoritative record did not identify known exploitation at the time checked. Avoid claims that the issue is under active attack unless AWS, CISA, or another reliable source publishes new evidence.
Frequently asked questions
What is the safe Kiro IDE version?
Kiro IDE 0.8.135 or later addresses CVE-2026-89332. Confirm the installed version after restarting the application.
Do I need to rotate credentials after updating?
If you opened a project in an affected Kiro version, AWS recommends rotating credentials that were present in that project. Prioritize privileged, production, and long-lived credentials.
Can I mitigate the flaw without updating?
AWS lists no workaround. Update to 0.8.135 or later rather than depending on a settings change or avoiding one panel.
Does the vulnerability exploit every repository automatically?
No. The documented path requires crafted repository content, an affected Kiro version, and user interaction involving the Powers panel. Nevertheless, an unfamiliar repository should be treated as untrusted input.
How severe is CVE-2026-89332?
The authoritative CVE record lists Medium severity, with CVSS scores of 5.5 under version 3.1 and 6.7 under version 4.0. The practical impact depends on what sensitive data the workspace could expose.
Conclusion
CVE-2026-89332 shows why AI coding tools need security boundaries that account for both model decisions and application state. Update Kiro IDE to 0.8.135 or later, inventory projects opened with older versions, rotate relevant credentials, and review suspicious settings or outbound connections. The durable lesson is broader: keep powerful credentials away from untrusted workspaces and ensure an agent’s proposed action cannot take effect before approval.