by Kastro
Paper/Archive/CVE-2026-112380

CVE-2026-112380

Amazon Kiro Crew — Missing authorization in the WhatsApp channel in Kiro Crew

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 34.9.349 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.

Affected

ProductAffectedFixed inSource
Kiro Crew0.4.0 – 0.7.1–CNA

Scores by source

AMZN (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AMZN (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/kirodotdev/KiroCrew/releases/tag/v0.7.2advisoryaws.amazon.com/security/security-bulletins/2026-140-awswriteupgithub.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc