Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2026-89332

5.5 · MEDIUM

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive inform…

Published Sep 11, 2026amazonCWE-201EPSS 0.18%

Overview

CVE-2026-89332 is a medium-severity vulnerability affecting amazon kiro_ide. It was published on September 11, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical description

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened.

To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.

Remediation

Check the references section for vendor advisories and patches from amazon. Update kiro_ide to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected products

VendorProductVersionsStatus
amazonkiro_ide>= 0, < 0.8.135Affected

References

Refaws.amazon.com/security/security-bulletins/2026-111-aws/Refkiro.dev/changelog/ide/0-8/#patch-0-8-135

How CyberStrike helps

Frequently asked questions

What is CVE-2026-89332?

CVE-2026-89332 is a medium-severity vulnerability affecting amazon kiro_ide. It was published on September 11, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2026-89332?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2026-89332?

Check the references section for vendor advisories and patches from amazon. Update kiro_ide to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-89332?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-89332 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Watch the demo →