CVE-2026-112380: Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiro Crewto a version that resolves this vulnerability.Fixed in 0.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote actor must be a member of an operator-configured WhatsApp group channel. An attacker does not need user interaction once they can send messages to that group.
What access could an attacker gain?
An affected group member may be able to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew. This can affect confidentiality, integrity, and availability.
Are all Kiro Crew deployments exposed?
The issue applies to deployments using an operator-configured WhatsApp group channel. The provided information does not establish exposure for deployments without such a group channel.
What is the remediation?
Upgrade Kiro Crew to version 0.7.2.