CVE-2026-112380
Deferred Deferred - Pending Action

Authorization Bypass in Kiro Crew WhatsApp Group Channel

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: AMZN

Description
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-29
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-112380
EUVD
EUVD-2026-105278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Amazon Kiro Crew 0.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization issue in the WhatsApp group channel of Kiro Crew. It allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions and execute arbitrary commands on the operator's machine via group messages.

Detection Guidance

Detecting this vulnerability requires checking Kiro Crew configurations and WhatsApp group settings. Verify if whatsapp.groups contains unauthorized entries and if whatsapp.dm_policy is set to open. Check agent session logs for unexpected commands executed by subagents.

Impact Analysis

An attacker could send malicious instructions through a WhatsApp group, potentially gaining control over the operator's other agent sessions and executing arbitrary commands on the host system running Kiro Crew.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized remote actors to execute arbitrary commands on the operator's machine through WhatsApp group messages. This unauthorized access may lead to data breaches, improper data handling, or lack of audit trail integrity, which are critical violations under these regulations.

Mitigation Strategies
  • Upgrade Kiro Crew to version 0.7.2 or later to address the vulnerability.
  • Remove entries from whatsapp.groups configuration to restrict group access.
  • Set whatsapp.dm_policy to self to prevent unauthorized direct messages.
  • Disable the WhatsApp channel until upgrading if immediate mitigation is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...