Remote Command Execution Vulnerability in Kiro Crew WhatsApp Integration
CVE-2026-112380

9CRITICAL

Key Information:

Vendor

Amazon

Status
Kiro Crew
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112380?

A missing authorization vulnerability in the WhatsApp group channel of Kiro Crew could enable a remote actor, who is a participant in an operator-configured WhatsApp group, to take control of other agent sessions. This could lead to the execution of arbitrary commands on the host system running Kiro Crew through messages sent within the group. To mitigate this risk, it is recommended to upgrade to version 0.7.2, which addresses this security issue.

Affected Version(s)

Kiro Crew 0.4.0 <= 0.7.1

References

https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/kirodotdev/KiroCrew/security/advisorie...
third-party-advisory

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.