← All incidents

CVE-2026-95985: a booby-trapped repo could get Kiro's agent to rewrite your global Kiro configuration

Vulnerability · Kiro IDE · HIGH

Summary

AWS published CVE-2026-95985 on Sep 24, 2026 for Kiro, its agentic IDE. AWS says that before version 1.0.242, the agent's file write tool could be steered by a crafted repository: if a user ran the agent in that repository as an untrusted workspace, sending any message could lead the agent to modify auto-loaded global configuration paths. AWS's bulletin says this might let a remote, unauthenticated attacker run arbitrary commands and inject instructions into the agent's context. AWS rates it CVSS 3.1 8.8 and CVSS 4.0 8.6, and credits researcher Dinh Ngoc Dung. The fix is in Kiro IDE 1.0.242, released Jul 28, 2026, so the bulletin came about two months after the patch. It is the second file write tool bulletin for Kiro this year, after CVE-2026-10591 in June. AWS has not published exploit details, and no exploitation has been reported. This is a backfill of an already-fixed issue.

Severity

Timeline

1. Jun 2, 2026
   AWS publishes bulletin 2026-037-AWS for CVE-2026-10591, an earlier Kiro file write tool flaw: crafted instructions could make the agent write to execution-sensitive paths such as .vscode/tasks.json, which run when the folder is opened. Fixed in Kiro IDE 0.11.
2. Jul 28, 2026
   Kiro IDE 1.0.242 is released. Its changelog says several sign-in, trust and approval issues are fixed.
3. Sep 24, 2026
   AWS publishes bulletin 2026-117-AWS for CVE-2026-95985, rated Important, and NVD publishes the CVE record the same day.

How it happened

Kiro's agent edits files through a built-in file write tool. AWS says that before 1.0.242, when the agent was working in a crafted repository opened as an untrusted workspace, instructions planted in that repository could make the tool write to global configuration paths that Kiro loads automatically. AWS does not say which files were reachable. Kiro's docs explain why that folder matters: ~/.kiro/settings/mcp.json holds user-level MCP servers that apply across all workspaces, ~/.kiro/steering/ holds global steering files that shape every session, and Kiro CLI also loads global hooks from ~/.kiro/hooks/. A change written there would not stay inside the malicious project. AWS lists the weaknesses as CWE-349 (accepting untrusted data alongside trusted data) and CWE-829 (inclusion of functionality from an untrusted control sphere). The earlier CVE-2026-10591 was the same tool reaching execution-sensitive files inside the workspace; this one is about files outside it.

How to check your app

• Update Kiro IDE to 1.0.242 or later.
• If you ran Kiro's agent in an untrusted workspace on an older version, do what AWS advises and review ~/.kiro (%USERPROFILE%\.kiro on Windows) for entries you did not create. Start with settings/mcp.json, the steering folder and any hooks.
• Read a cloned repository's .kiro folder and any instruction-style files before letting the agent work in it.

Related on VibeIncidents

• Amazon Q Developer could start MCP servers defined in a repo when you opened the project (CVE-2026-12957)

Sources

• AWS security bulletin 2026-117-AWS: CVE-2026-95985
• NVD: CVE-2026-95985
• Kiro IDE changelog: 1.0.242 (Jul 28, 2026)
• AWS security bulletin 2026-037-AWS: CVE-2026-10591
• NVD: CVE-2026-10591
• Kiro docs: MCP configuration
• Kiro docs: Steering
• Kiro docs: Hooks

Corrections and updates

None. Re-checked against every source on Oct 17, 2026.