CVE-2026-89332

Executive Summary

CVE-2026-89332 is a sensitive-information disclosure flaw (CWE-201) in the Kiro Powers feature of the Amazon Kiro IDE affecting versions before 0.8.135. A remote, unauthenticated attacker can craft malicious repository content that causes the coding agent to rewrite the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint that exfiltrates workspace data when the Powers panel is opened. Developers who open untrusted repositories in an affected Kiro IDE build may leak secrets present in that project, and should both upgrade and rotate any credentials that were exposed.

Technical Analysis

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), which aligns with the "inclusion of functionality from an untrusted control sphere" framing in the NVD description. The root cause sits in the Kiro Powers subsystem, which is responsible for fetching and rendering a "registry" of Powers (extensible agent capabilities/plugins) inside the IDE.

Per the NVD description, the attack chain is driven by crafted repository content. When a developer opens such a repository, the embedded content induces the Kiro agent to modify the workspace settings file. That settings file, in turn, controls where the Kiro Powers registry is requested from. By pointing the registry configuration at an attacker-controlled endpoint, the attacker effectively redirects the IDE's own registry lookup to a server they operate. Once the registry request is redirected, the IDE transmits workspace data to that endpoint — and this exfiltration occurs when the Powers panel is opened, meaning the leak is triggered by a normal, expected user interaction rather than a covert background action.

Two properties make this notable:

1. Trust-boundary violation — Repository content is treated as data by the developer, but Kiro's agent treats it as a control input that can mutate workspace settings, an operation that should not be influenced by untrusted project contents. This is the "untrusted control sphere" boundary crossing that CWE-201 captures.
2. Unauthenticated remote trigger — The CVSS vector shows PR:N with no network privilege requirement; the only precondition is that a victim opens the project and (per the description) opens the Powers panel. That condition is captured by UI:R (User Interaction Required).

The confidentiality impact is High (C:H) because the workspace data redirected to the attacker endpoint can include sensitive developer material — tokens, API keys, environment files, and other credentials typically present in a developer workstation workspace. Integrity and Availability impacts are None (I:N/A:N): the vulnerability does not modify or destroy data in a way that affects those subscopes; its purpose is disclosure.

CVSS 3.1 scoring breaks down as AV:L (the malicious repository must be opened locally, not delivered over the network by the attacker), AC:L (no unusual conditions required beyond the described interaction), PR:N (attacker needs no prior privileges), UI:R (victim must open the project/repository and interact with the Powers panel), S:U (impact stays within the IDE/workspace scope), C:H/I:N/A:N, yielding 5.5 (Medium). Note the AV:L subscore can understate real risk because the effect (exfiltration) is remote in nature.

The description notes "might allow" — this hedged language is common in coordinated-disclosure text and here reflects the attacker-controlled nature of the redirect: whether exfiltration succeeds depends on the developer opening the panel and on workspace contents including sensitive data.

No public proof-of-concept, exploit code, or Nuclei template exists in the provided data. The exact settings-file key that holds the registry URL, the precise payload format that coerces the agent into rewriting settings, and the URL path structure of the registry request are not disclosed in the NVD description and are therefore not asserted here. Any claim about specific file paths, setting names, or request parameters would be speculation.

Exploitation Scenarios

This section describes the attack chain strictly at the level supported by the NVD description. No public PoC is available; the chain below is inferred from the vulnerability class (untrusted-functionality inclusion / CWE-201) and the explicit mechanics named in the advisory.

1) Reconnaissance / target identification. The attacker identifies targets by looking for developers who use the Amazon Kiro IDE and who habitually open third-party or untrusted repositories. Attack surface includes public code hosting platforms, forks, dependency repositories, and any repository the developer clones from an untrusted source. The attacker prepares a repository that looks plausible and useful (a library, a template project, a "try this" sample) to maximize the chance it is opened.

2) Triggering the flaw. The crafted repository content is embedded in files that the Kiro agent reads while the project is opened. Per the NVD description, this content causes the agent to modify the workspace settings file. The specific mechanism by which the agent is manipulated into that settings write is not detailed in the advisory, but the effect is precisely stated: the workspace settings are altered so that the Kiro Powers registry request redirects to an actor-controlled endpoint. The redirect is therefore a passive configuration change — the attacker does not need to intercept traffic; they simply get the IDE to point at their own server.

3) Payload/execution at the vulnerability-class level. Once workspace settings are altered, no further exploit code is required. The victim's next normal action — opening the Powers panel — causes the IDE to issue the registry request to the attacker-controlled endpoint, and the IDE transmits workspace data as part of that request. In CWE-201 terms, the IDE "inserts sensitive information into sent data," sending workspace contents to a destination the attacker controls. Because the redirect is configured via the workspace settings, the request appears to come from the trusted IDE process, not from the repository.

4) Post-exploitation impact. The attacker receives workspace data at their endpoint. Depending on what the developer's workspace contains, this may include credentials, API tokens, configuration secrets, and proprietary source. The advisory explicitly instructs users who opened a project in an earlier version to rotate any credentials present in that project, confirming that credential material in the workspace is in scope for exposure. There is no listed impact on integrity or availability; the outcome is disclosure. The attacker can then use harvested credentials for follow-on access to cloud services, package registries, or other systems for which the leaked secrets grant rights.

Because exploitation requires the victim to open the repository and then open the Powers panel, campaigns would most likely use social engineering or dependency-based distribution rather than mass scanning. The absence of a public PoC lowers immediate opportunistic risk but does not eliminate targeted risk.

Impact Assessment

The CVSS 3.1 base score is 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The confidentiality subscore is High, reflecting that workspace data — which routinely includes secrets — can be exfiltrated. Integrity and availability are None. The Scope is Unchanged: the effect is confined to the vulnerable component (the IDE/workspace) even though the data leaves it.

Business impact stems from credential and intellectual-property loss:

• Credential compromise: Developers frequently keep tokens (cloud provider keys, package registry tokens, CI/CD secrets, source-control tokens) in workspaces. Exfiltration of these enables follow-on intrusion into production and build systems, potentially escalating from one workstation to broader cloud or supply-chain compromise.
• Source code disclosure: Proprietary and pre-release source may be leaked, harming IP and possibly enabling downstream supply-chain attacks.
• Distribution may be broad but targeted: Any Kiro IDE user below 0.8.135 who opens an untrusted project is affected; blast radius is limited to users who actually open malicious repos and interact with the Powers panel.

Affected systems: developer workstations running Amazon Kiro IDE versions earlier than 0.8.135. There is no server-side or network-perimeter component in the affected path; the CVSS AV:L emphasizes that exploitation is initiated locally via an opened project. There is no CISA KEV listing and no known exploit-in-the-wild evidence in the provided data, and EPSS has not yet assigned a score. Because the confidentiality subscore is High and the payload is credential theft, this warrants remediation priority for development fleets, even though the base score is only Medium.

Detection Guidance

Detection should target the behavioral artifacts of this chain: unexpected creation or modification of workspace settings after opening a repository, and outbound network requests from the Kiro IDE to non-corporate/unknown hosts (especially when the Powers panel is opened). Because the exact settings file path, registry URL, and request parameters are not disclosed, the rules below are written to be robust — detecting settings-file writes by the IDE/agent process and anomalous egress — rather than matching on unverified strings.

Sigma Rule

title: Potential Kiro IDE Workspace Settings Modification by Agent (CVE-2026-89332)
id: 4d9f2c7a-8933-4b1e-9c2e-1a2b3c4d5e6f
status: experimental
description: Detects modifications to Kiro IDE workspace settings files shortly after a workspace/project is opened, consistent with agent-driven settings tampering that can redirect the Kiro Powers registry request to an attacker-controlled endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89332
author: Threat Intel - valtersit.com
date: 2026/01/01
tags:
  - attack.t1195
  - cve.2026.89332
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\Kiro.exe'
      - '\kiro.exe'
  selection_target:
    TargetFilename|endswith:
      - '\.kiro\settings.json'
      - '\settings.json'
  filter_trusted_editor:
    # Interactive editor writes are expected; agent-driven bulk writes are not
    ParentImage|endswith:
      - '\Kiro.exe'
  condition: selection_process and selection_target and not filter_trusted_editor
falsepositives:
  - Legitimate user editing workspace settings in the IDE UI
  - IDE plugin installation updating settings
level: medium

YARA Rule

rule CVE_2026_89332_Kiro_Powers_Registry_Redirect
{
    meta:
        description = "Detects repository content that may coerce Kiro IDE into rewriting workspace settings to redirect the Kiro Powers registry to an attacker-controlled endpoint (CVE-2026-89332)"
        author = "Threat Intel - valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89332"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $kiro  = "Kiro" ascii wide nocase
        $pwr   = "Powers" ascii wide nocase
        $reg   = "registry" ascii wide nocase
        $ws    = "workspace" ascii wide nocase
        $set   = "settings" ascii wide nocase
        $http  = "http" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 2MB and
        (($kiro and $pwr and $reg) or
         ($kiro and $ws and $set)) and
        2 of ($http, $reg, $pwr)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-89332 Possible Kiro Powers Registry Redirect - Outbound Registry Fetch to Non-Corporate Host"; flow:established,to_server; http.method; content:"GET"; http.header; content:"User-Agent"; content:"Kiro"; nocase; content:"Powers"; nocase; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-89332; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-89332; classtype:attempted-recon; sid:202689332; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=10m
  [ process where process.name : "Kiro.exe" and event.action == "start" ]
  [ file where event.action in ("creation", "modification") and
      file.name : "settings.json" and
      file.path : "*\\workspace*" ]

Splunk SPL Query

index=endpoint OR index=edr sourcetype IN (XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, WinEventLog:Security)
(Image="*\\Kiro.exe" AND (TargetFilename="*settings.json" OR TargetFilename="*.kiro*"))
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files by host, User, Image
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="kiro,cve-2026-89332,">
  <rule id="202693" level="10">
    <decoded_as>json</decoded_as>
    <field name="win.eventdata.image">\.exe$</field>
    <match>Kiro</match>
    <field name="win.eventdata.targetFilename">settings\.json$</field>
    <description>CVE-2026-89332: Kiro IDE process modified workspace settings.json - possible Powers registry redirect.</description>
    <mitre>
      <id>T1195</id>
    </mitre>
    <group>file_event,cve_2026_89332,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (interim):

• Treat every untrusted repository as hostile: do not open third-party or unknown repositories in Kiro IDE builds earlier than 0.8.135 as sole mitigation is not reliable — upgrading is required.
• After any exposure in an affected version, rotate all credentials present in the exposed project, as explicitly advised in the NVD description (cloud keys, registry tokens, environment-file secrets, SSH material stored in-project).
• Restrict outbound egress from developer workstations to approved destinations where operationally feasible, to blunt the registry-redirect exfiltration path.
• Monitor workspace settings files for unexpected changes and review them (particularly any settings controlling registry/Powers sources) before opening the Powers panel.
• Remove known secret material from repository workspaces; use a secrets manager rather than in-project files.

2) Patch / upgrade steps:

• Upgrade Kiro IDE to version 0.8.135 or later on all developer workstations. Verify the installed version after upgrade.
• No vendor-supplied independent mitigation or workaround is listed; version upgrade is the remediation specified by the vendor in the advisory.
• Rotate and re-issue any credentials that were present in projects opened in affected versions, then confirm in access logs that leaked credentials were not misused.

3) Long-term hardening:

• Enforce a minimum supported IDE version and policy requiring agentic coding tools to be patched before use on corporate devices.
• Default to least-privilege, short-lived, scoped credentials; avoid long-lived secrets in workspaces and rotate on a schedule.
• Add detection content (above) to CI/CD and endpoint monitoring to catch settings tampering and anomalous IDE egress.
• Require review of agent-capable IDE configuration changes; prevent untrusted project content from influencing IDE-agent control settings.
• Maintain an inventory of AI/agentic developer tooling and monitor vendor advisories for the Kiro IDE and Powers feature.

References

• NVD — CVE-2026-89332: https://nvd.nist.gov/vuln/detail/CVE-2026-89332
• CWE-201 — Insertion of Sensitive Information Into Sent Data (see also CWE-829, Inclusion of Functionality from Untrusted Control Sphere): https://cwe.mitre.org/data/definitions/201.html
• Amazon Kiro IDE (vendor product) — users should upgrade to version 0.8.135 or later per the advisory; consult the vendor's official advisory/security page for the release containing the fix.
• CISA Known Exploited Vulnerabilities catalog: NOT listed as of this report (no KEV entry). https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Threat actor campaign / exploit-in-the-wild evidence: None identified in the provided data; no public PoC, exploit code, or Nuclei template was available at the time of writing.