type: cve · created: 2026-07-23 · updated: 2026-07-23 · tags: [cve, mcp, ide, aws, config-poisoning, code-execution] · confidence: high · severity: not-rated · affected_sectors: [technology] · au_impact: true
AWS Kiro IDE MCP Config Flaw
Researchers at Intezer and Kodem Security discovered that a poisoned web page could make AWS Kiro — AWS's agentic coding IDE — rewrite its configuration file (mcp.json) and run attacker-controlled code, with no approval step capable of stopping it. AWS has patched the issue.
Vulnerability Details
| Attribute | Detail |
|---|---|
| Product | AWS Kiro (agentic coding IDE) |
| Weak point | MCP server config file (mcp.json) |
| Attack vector | Poisoned web page triggers config rewrite → arbitrary code execution |
| Approval bypass | No user approval step could prevent the attack |
| Discovered by | Intezer & Kodem Security |
| Status | Patched by AWS |
| Disclosure date | 2026-07-21 |
Attack Vector
The MCP (Model Context Protocol) server configuration in Kiro's mcp.json file was writable by the agent without user consent. A malicious web page could cause the agent to:
1. Rewrite mcp.json with attacker-controlled MCP server definitions
2. Trigger execution of arbitrary code through the poisoned MCP servers
3. No approval prompt was shown to the user
This is another example of MCP trust-boundary weaknesses in AI coding assistants.
Mitigation
- AWS has patched the issue — Kiro users should ensure they are running the latest version
- Organisations using agentic IDEs should review MCP server configuration permissions
Related Pages
- Mcp Tool Poisoning — Poisoned MCP tool descriptions trick AI agents into leaking data
- Ghostapproval — Symlink attacks on AI coding assistants (related approval-bypass pattern)
- Friendly Fire Ai Hijacking — AI agent hijacking during untrusted code review