# CVE-2026-10591: CVE-2026-10591: AWS Kiro Rewrites Its Own MCP Config for Silent RCE (CVSS 8.8)

> CVE-2026-10591 is a critical-severity remote code execution issue (CVSS 8.8) in Kiro IDE, a MCP server. Affected: Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16). Fixed in 0.11.130.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-10591
- **Aliases:** ti-054
- **Severity:** critical
- **CVSS:** 8.8
- **Attack type:** Remote code execution, Prompt injection
- **Component:** Kiro IDE (MCP server)
- **Catalog entry:** https://catalog.anomity.ai/agent/kiro
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-20
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-10591

## Summary

Intezer and Kodem Security showed that hidden instructions on an ordinary web page could make AWS Kiro rewrite its own MCP server config and execute attacker code. Kiro reads the server list and each startup command from ~/.kiro/settings/mcp.json, reloads the file whenever it changes, and could write to it with its own fsWrite tool without asking for approval. The proof of concept hid its payload in one-pixel white text on an API documentation page, so a request as ordinary as "summarize this page" ended in code execution with the developer's privileges. AWS assigned CVE-2026-10591 (CVSS 8.8) and fixed it in Kiro 0.11.130.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16) | 0.11.130 |

## Am I affected by CVE-2026-10591?

You are affected if you run Kiro IDE < 0.11.130 (confirmed vulnerable on 0.9.2 and 0.10.16). Versions 0.11.130 and later include the fix.

## How do I fix CVE-2026-10591?

Upgrade Kiro to 0.11.130+. Treat any agent-writable MCP config as an execution boundary: alert on changes to ~/.kiro/settings/mcp.json, and require approval for agent writes to any config file the tool auto-reloads.

## How do I find every machine running Kiro IDE?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Kiro IDE and which version, then enforce a policy on it.

## References

- article: https://research.intezer.com/blog/2026/07/remote-code-execution-kiro/
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-10591

## Related vulnerabilities

- [kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown](https://catalog.anomity.ai/vuln/kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-10591