# CVE-2026-89332: Kiro IDE sensitive workspace data exfiltration via agent-written configuration

Source: https://junglewise.ai/threats/cve-2026-89332-kiro-ide-sensitive-workspace-data-exfiltration-via-agent-written  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-89332 · Severity: high · CVSS 5.5 · Published 2026-09-11

Kiro IDE is an AI-assisted development environment that helps developers build software. A vulnerability allows a malicious code repository to trick the Kiro agent into modifying the workspace settings to redirect requests to an attacker-controlled server, potentially exposing sensitive workspace information. Because the file is written before the user sees the approval prompt, an attacker can exfiltrate data by simply opening the Powers panel before the user responds to the confirmation dialog.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [AWS Kiro IDE](https://junglewise.ai/threats/technologies/kiro-ide). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [AWS](https://junglewise.ai/threats/vendors/aws).

## Quick answers

**Is CVE-2026-89332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89332 being exploited in the wild.

**How severe is CVE-2026-89332?** High severity, with a CVSS score of 5.5, published 11 September 2026.

**Which products and versions are affected?** AWS Kiro IDE < 0.8.135.

**Is there a fix for CVE-2026-89332?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89332 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89332?** Check whether you run Amazon AWS or AWS Kiro IDE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-89332 is a configuration injection vulnerability in Kiro IDE where the agentic system can write to workspace settings files without proper preconditions or atomic operations. A specially crafted repository can exploit this by having the Kiro agent modify the workspace configuration to point the Powers registry URL to an attacker-controlled endpoint. The vulnerability exists because the settings file is written to disk before the user approval prompt is displayed; if a user opens the Powers panel before declining the modification, the request to the malicious URL is made anyway, transmitting potentially sensitive workspace data. Kiro did present the edit to the user for approval showing the inserted data and URL, but the race condition between file write and user confirmation allows exploitation. The vulnerability affects Kiro IDE versions prior to 0.8.135. No public exploits in the wild have been reported at the time of advisory publication.

## Affected products

- AWS Kiro IDE < 0.8.135

## Timeline

- 2026-09-11: disclosed
- 2026-09-11: advisory: AWS Security Bulletin 2026-111-AWS published

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)