Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote… (CVE-2026-89332)
Amazon Kiro IDE versions before 0.8.135 contain a vulnerability in the Kiro Powers feature where untrusted functionality can be included. This flaw allows remote unauthenticated actors to obtain sensitive information from a developer workstation by manipulating workspace settings to redirect registry requests to attacker-controlled endpoints. The issue is remediated by upgrading to version 0.8.135 or later. Users who opened projects in affected versions should rotate any credentials present in those projects.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-89332) in Amazon Kiro IDE prior to version 0.8.135 involves the inclusion of functionality from an untrusted control sphere within the Kiro Powers feature. Crafted repository content can cause the IDE agent to modify the workspace settings file, redirecting Kiro Powers registry requests to an attacker-controlled endpoint. When the Powers panel is opened, workspace data is sent to this endpoint, potentially exposing sensitive information from the developer's workstation. The vulnerability requires user interaction (opening the Powers panel) and local access to the repository content to trigger the issue.
Potential Impact
Remote unauthenticated actors can obtain sensitive information from developer workstations by exploiting this vulnerability. The confidentiality of workspace data is compromised, but integrity and availability are not impacted. The CVSS score of 5.5 (medium severity) reflects the need for user interaction and local repository manipulation for exploitation.
Mitigation Recommendations
Users should upgrade Amazon Kiro IDE to version 0.8.135 or later to remediate this vulnerability. Additionally, users who opened projects in affected versions should rotate any credentials that were present in those projects to prevent potential misuse of exposed sensitive information.
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote… (CVE-2026-89332)
Description
Amazon Kiro IDE versions before 0.8.135 contain a vulnerability in the Kiro Powers feature where untrusted functionality can be included. This flaw allows remote unauthenticated actors to obtain sensitive information from a developer workstation by manipulating workspace settings to redirect registry requests to attacker-controlled endpoints. The issue is remediated by upgrading to version 0.8.135 or later. Users who opened projects in affected versions should rotate any credentials present in those projects.
CVSS v3.1
Score 5.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-89332) in Amazon Kiro IDE prior to version 0.8.135 involves the inclusion of functionality from an untrusted control sphere within the Kiro Powers feature. Crafted repository content can cause the IDE agent to modify the workspace settings file, redirecting Kiro Powers registry requests to an attacker-controlled endpoint. When the Powers panel is opened, workspace data is sent to this endpoint, potentially exposing sensitive information from the developer's workstation. The vulnerability requires user interaction (opening the Powers panel) and local access to the repository content to trigger the issue.
Potential Impact
Remote unauthenticated actors can obtain sensitive information from developer workstations by exploiting this vulnerability. The confidentiality of workspace data is compromised, but integrity and availability are not impacted. The CVSS score of 5.5 (medium severity) reflects the need for user interaction and local repository manipulation for exploitation.
Mitigation Recommendations
Users should upgrade Amazon Kiro IDE to version 0.8.135 or later to remediate this vulnerability. Additionally, users who opened projects in affected versions should rotate any credentials that were present in those projects to prevent potential misuse of exposed sensitive information.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gpq4-73r8-h3fj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89332"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6aa4a02655bf5e2cf5a869c6
Added to database: 09/12/2026, 00:43:18 UTC
Last enriched: 09/12/2026, 01:18:24 UTC
Last updated: 09/12/2026, 03:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.