Attributed metadata history
Up to 100 retained publisher events per page for 8bc4f96146ca569c3c68f135aac175a3a9995216b790cd132c831b69a5ae7c0b. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
available
Fingerprint: 596c214e60f67af37a9e8175e4f5cd1a8ccaa6da5d5c0b2911f426d14b9208a6
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
Bulletin ID: 2026-111-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 12:00 PM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-89332, where the Kiro agent could modify a workspace's settings file in an untrusted workspace in Kiro IDE. A specially crafted repository could use this to point the Kiro Powers registry URL, which Kiro fetches when the Powers panel is opened, at an external endpoint, sending potentially sensitive workspace data to that endpoint. Kiro presented the edit to the user for approval, showing the inserted data and the URL, but the file was already written to disk, so opening the Powers panel before responding to the prompt made the request anyway. Impacted versions: Kiro IDE < 0.8.135 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Fingerprint: 41d7ca0cac03505bc16925d326583fb1bff3126d2cc3f357975b813befc102a0