{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-10591",
    "name": "CVE-2026-10591",
    "vendor": "Kiro IDE",
    "description": "Intezer and Kodem Security showed that hidden instructions on an ordinary web page could make AWS Kiro rewrite its own MCP server config and execute attacker code. Kiro reads the server list and each startup command from ~/.kiro/settings/mcp.json, reloads the file whenever it changes, and could write to it with its own fsWrite tool without asking for approval. The proof of concept hid its payload in one-pixel white text on an API documentation page, so a request as ordinary as \"summarize this page\" ended in code execution with the developer's privileges. AWS assigned CVE-2026-10591 (CVSS 8.8) and fixed it in Kiro 0.11.130.",
    "website": "https://research.intezer.com/blog/2026/07/remote-code-execution-kiro/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-20",
    "risk": {
      "score": 88,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-10591",
      "aliases": [
        "ti-054"
      ],
      "title": "CVE-2026-10591: AWS Kiro Rewrites Its Own MCP Config for Silent RCE (CVSS 8.8)",
      "summary": "Intezer and Kodem Security showed that hidden instructions on an ordinary web page could make AWS Kiro rewrite its own MCP server config and execute attacker code. Kiro reads the server list and each startup command from ~/.kiro/settings/mcp.json, reloads the file whenever it changes, and could write to it with its own fsWrite tool without asking for approval. The proof of concept hid its payload in one-pixel white text on an API documentation page, so a request as ordinary as \"summarize this page\" ended in code execution with the developer's privileges. AWS assigned CVE-2026-10591 (CVSS 8.8) and fixed it in Kiro 0.11.130.",
      "severity": "critical",
      "cvss": {
        "score": 8.8,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Kiro IDE",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/kiro"
      },
      "affected": [
        {
          "range": "Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16)",
          "fixed": "0.11.130"
        }
      ],
      "exploited": false,
      "exploitPublic": true,
      "publishedAt": "2026-07-20",
      "modifiedAt": "2026-07-20",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://research.intezer.com/blog/2026/07/remote-code-execution-kiro/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10591"
        }
      ],
      "mitigation": "Upgrade Kiro to 0.11.130+. Treat any agent-writable MCP config as an execution boundary: alert on changes to ~/.kiro/settings/mcp.json, and require approval for agent writes to any config file the tool auto-reloads.",
      "detectedByAnomity": true
    }
  }
}