CVE-2026-10591: AWS Kiro Rewrites Its Own MCP Config for Silent RCE (CVSS 8.8)
CVE-2026-10591 is a critical-severity remote code execution issue (CVSS 8.8) in Kiro IDE, a MCP server. Affected: Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16). Fixed in 0.11.130.
Is Kiro IDE running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-10591- Severity
- critical
- CVSS score
- 8.8
- Attack type
- Remote code execution, Prompt injection
- Component
- Kiro · MCP server
- Known exploited
- No known exploitation
- Public exploit
- Yes
- Published
- Last verified
What is CVE-2026-10591?
Intezer and Kodem Security showed that hidden instructions on an ordinary web page could make AWS Kiro rewrite its own MCP server config and execute attacker code. Kiro reads the server list and each startup command from ~/.kiro/settings/mcp.json, reloads the file whenever it changes, and could write to it with its own fsWrite tool without asking for approval. The proof of concept hid its payload in one-pixel white text on an API documentation page, so a request as ordinary as "summarize this page" ended in code execution with the developer's privileges. AWS assigned CVE-2026-10591 (CVSS 8.8) and fixed it in Kiro 0.11.130.
Affected versions
| Affected | Fixed in |
|---|---|
Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16) | 0.11.130 |
Am I affected by CVE-2026-10591?
You are affected if you run Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16). Versions 0.11.130 and later include the fix.
How do I fix CVE-2026-10591?
Upgrade Kiro to 0.11.130+. Treat any agent-writable MCP config as an execution boundary: alert on changes to ~/.kiro/settings/mcp.json, and require approval for agent writes to any config file the tool auto-reloads.
How do I find every machine running Kiro IDE?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Kiro IDE and which version, then enforce a policy on it.