CVE-2026-9255 is a vulnerability in AWS Kiro CLI prior to version 1.28.0 involving missing authorization checks in the tool authorization prompt. This flaw allows a local attacker to bypass user approval and execute arbitrary commands by supplying crafted input via standard input (stdin). The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, and requiring user interaction. AWS has published a security bulletin recommending upgrading to version 1.28.0 or later to address this issue. As the product is a cloud service, AWS manages the remediation process server-side.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary tools or shell commands without user approval, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. The CVSS score of 7.8 indicates a high impact on security properties. There are no known exploits in the wild currently reported.

AWS recommends upgrading to AWS Kiro CLI version 1.28.0 or later to remediate this vulnerability. Since this is a cloud-hosted service, AWS manages the remediation server-side. Users should consult the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-035-aws/ for the latest patch status and guidance. No additional user action is required beyond applying the update as recommended by AWS.