{"id":"CVE-2026-112380","kind":"vulnerability","aliases":["CVE-2026-112380"],"related":[],"title":"Kiro Crew: WhatsApp group members can run commands on the host","description":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\n### CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\nBulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT\n\nDescription:\n\nKiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine.\n\nWe identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subagent run-control endpoints. In certain configurations where a WhatsApp group was added to an operator's allowed groups, or where the direct-message policy was set to open, a member of that WhatsApp group could send instructions to another session's subagent. The subagent then executed those instructions on the operator's machine under that session's approval policy, and the resulting audit trail was attributed to the operator rather than the actual sender.\n\nThe default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, so a group that is not explicitly listed is dropped before dispatch.\n\nImpacted versions: >=0.4.0 AND <0.7.2\n\nResolution:\n\nThis issue has been addressed in Kiro Crew version 0.7.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The fix (PR #14338) makes WhatsApp group traffic subject to the same per-user allowlist as direct messages (deny by default), runs untrusted turns on a dedicated tool-less agent so the untrusted flag no longer depends on a permission prompt, and requires a verified caller identity with an ownership check on every subagent run-control route.\n\nWorkarounds:\n\nRemove every entry from whatsapp.groups and keep whatsapp.dm_policy at self (the default). With no listed group, group traffic is dropped before any dispatch. Alternatively, disable the WhatsApp channel until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-112380\n- GHSA-x4jf-p42g-q3hc\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Kiro Crew (AWS open-source personal AI agent) versions 0.4.0 to 0.7.1 lack authorization checks in the WhatsApp channel and the internal subagent run-control endpoints. If the operator listed a WhatsApp group in whatsapp.groups, or set whatsapp.dm_policy to open, a member of that group can send instructions to another session's subagent. The subagent runs them on the host under that session's approval policy, and the audit log names the operator, not the sender. The default configuration is not affected. CVSS 9.9.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kirocrew","fixed":["0.7.2"],"affected":">= 0.4.0, < 0.7.2","ecosystem":"pip"}],"ecosystems":["pip"],"tags":["ai-agents","ai-tooling","aws","kiro-crew","lab-disclosure","pip","self-hosted","whatsapp"],"not_affected_if":["default-config","whatsapp-channel-disabled","whatsapp-disabled"],"how_to_check":"Run pip show kirocrew: exposed if version is >=0.4.0 and <0.7.2. Then open your Kiro Crew config: exposed only if whatsapp.groups has any entries or whatsapp.dm_policy is open. Defaults (groups empty, dm_policy self) are not exposed. Also review the audit log: actions run via this bug are attributed to the operator, not the sender.","fix":"Upgrade to kirocrew 0.7.2 (pip install -U kirocrew); also patch any forks. Workaround: remove every entry from whatsapp.groups, keep whatsapp.dm_policy at self, or disable the WhatsApp channel.","status":"open","published_at":"2026-10-20T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:20+00:00","updated_at":"2026-10-24T19:28:16+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-10-23T22:39:20Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Kiro Crew to version 0.7.2.","reach":"internet","title":"Kiro Crew: WhatsApp group members can run commands on the host","impact":"high","summary":"Kiro Crew's WhatsApp group channel does not check authorization, so anyone in an operator-configured WhatsApp group can send messages that control other agent sessions. An attacker can execute arbitrary commands on the machine running Kiro Crew.","category":"ai-tooling","who_cares":["kiro-crew","whatsapp","ai-agents","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote group member runs arbitrary commands on the Kiro Crew host.","analyst_note":"Confirm the affected version range and how to tell whether the WhatsApp channel is enabled, using the NVD entry and the Kiro Crew release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["whatsapp-channel-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000489,"input_tokens":2955,"output_tokens":386,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range and how to tell whether the WhatsApp channel is enabled, using the NVD entry and the Kiro Crew release notes.","search":"'-112380':14A,17A,126C,138C,207C,458C '-140':151C '-2026':13A,16A,125C,137C,206C,457C '0.4.0':47B,325C '0.7.1':49B '0.7.2':327C,338C '00':164C '10/20/2026':162C '13':163C '14338':363C '2026':150C '9.9':123B 'actual':293C 'add':231C 'address':333C 'affect':121B,300C 'agent':21B,45B,177C,391C 'ai':20B,23B,44B,176C 'ai-ag':19B 'ai-tool':22B 'allow':236C 'allowlist':375C 'altern':445C 'anoth':89B,259C 'appli':454C 'approv':104B,278C 'attent':159C 'attribut':286C 'audit':108B,283C 'author':51B,128C,140C,209C 'aw':25B,39B,152C,154C 'aws-security@amazon.com':466C 'bulletin':148C 'caller':407C 'certain':224C 'channel':56B,132C,144C,190C,214C,449C 'check':52B,412C 'cli':187C 'code':352C 'command':8A 'concern':472C 'configur':118B,225C,297C 'content':155C 'control':63B,221C,418C 'could':255C 'crew':2A,28B,38B,135C,147C,169C,336C 'cve':12A,15A,124C,136C,205C,456C 'cvss':122B 'dashboard':185C 'date':161C 'dedic':387C 'default':117B,296C,302C,308C,381C,433C 'deni':379C 'depend':398C 'deriv':351C 'descript':167C 'direct':242C,377C 'direct-messag':241C 'disabl':446C 'disclosur':31B 'dispatch':322C,444C 'drop':320C,441C 'email':465C 'empti':304C 'endpoint':64B,222C 'ensur':347C 'entri':423C 'everi':414C,422C 'execut':266C 'explicit':317C 'fix':359C,361C 'flag':395C 'fork':349C 'ghsa':460C 'ghsa-x4jf-p42g-q3hc':459C 'group':4A,71B,84B,229C,237C,254C,313C,366C,437C,438C 'host':11A,35B,99B 'id':149C 'ident':408C 'identifi':204C 'impact':323C 'import':157C 'incorpor':356C 'instruct':87B,257C,268C 'intern':59B,217C 'issu':210C,330C 'keep':427C 'kiro':1A,27B,37B,134C,146C,168C,335C 'kiro-crew':26B 'kirocrew':18A 'lab':30B 'lab-disclosur':29B 'lack':50B 'latest':344C 'less':390C 'list':68B,318C,436C 'log':109B 'longer':397C 'machin':202C,273C 'make':364C 'member':5A,81B,250C 'messag':189C,243C,378C 'miss':127C,139C 'name':110B 'new':358C 'open':41B,79B,173C,248C 'open-sourc':40B,172C 'oper':67B,112B,200C,234C,271C,289C 'ownership':411C 'p42g':462C 'patch':354C 'pdt':166C 'per':373C 'per-us':372C 'permiss':401C 'person':43B,175C 'pip':32B 'pleas':464C 'pm':165C 'polici':77B,105B,244C,279C,307C,429C 'pr':362C 'prompt':402C 'public':160C 'q3hc':463C 'question':470C 'rather':290C 'reach':181C 'recommend':340C 'refer':455C 'remov':421C 'requir':158C,404C 'resolut':328C 'result':282C 'rout':419C 'run':7A,62B,95B,196C,220C,382C,417C 'run-control':61B,219C,416C 'scope':153C 'secur':469C 'self':34B,310C,431C 'self-host':33B 'send':86B,256C 'sender':115B,294C 'session':90B,102B,260C,276C 'set':75B,246C 'sourc':42B,174C 'subag':60B,92B,94B,218C,262C,264C,415C 'subject':368C 'tool':24B,197C,389C 'tool-less':388C 'traffic':367C,439C 'trail':284C 'turn':384C 'type':156C 'untrust':383C,394C 'upgrad':341C,452C 'user':374C 'verifi':406C 'version':46B,324C,337C,345C 'web':184C 'whatsapp':3A,36B,55B,70B,131C,143C,193C,213C,228C,253C,365C,448C 'whatsapp.dm':76B,306C,428C 'whatsapp.groups':73B,301C,425C 'workaround':420C 'x4jf':461C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"Kiro Crew WhatsApp channel (whatsapp.groups and whatsapp.dm_policy settings)","since":null,"covers":"Group messages from WhatsApp groups not explicitly listed in whatsapp.groups are dropped before dispatch, while dm_policy stays at self","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","vendor":"Team","seen_at":"2026-10-24T19:28:08Z","confidence":0.9,"source_title":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew","customer_action":"Remove every entry from whatsapp.groups and keep whatsapp.dm_policy at self (the default) until upgrading to 0.7.2"},{"kind":"workaround","scope":"Kiro Crew WhatsApp channel","since":null,"covers":"All WhatsApp channel traffic, since the channel is disabled","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","vendor":"Team","seen_at":"2026-10-24T19:28:08Z","confidence":0.85,"source_title":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew","customer_action":"Disable the WhatsApp channel until the upgrade to Kiro Crew 0.7.2 is applied"}],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112380","severity":null,"published_at":"2026-10-20T20:17:16+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112380:273","url":null,"severity":null,"published_at":"2026-10-23T22:40:31+00:00","modified_at":"2026-10-23T22:40:31+00:00","first_seen_at":"2026-10-23T22:40:31+00:00","fetched_at":"2026-10-23T22:40:31+00:00","note":"Read GHSA-x4jf-p42g-q3hc and AWS bulletin 2026-140-AWS via search snippets and CVE record (full pages not fetched; v0.7.2 release page linked from CVE record, not read). Affected >=0.4.0 <0.7.2; non-default config only. No exploitation or PoC reported. No social search done."},{"source":"analyst","external_id":"CVE-2026-112380:365","url":null,"severity":null,"published_at":"2026-10-23T23:05:55+00:00","modified_at":"2026-10-23T23:05:55+00:00","first_seen_at":"2026-10-23T23:05:55+00:00","fetched_at":"2026-10-23T23:05:55+00:00","note":"Read GHSA-x4jf-p42g-q3hc in full: affected >=0.4.0 <0.7.2, fixed 0.7.2, non-default config only (whatsapp.groups non-empty or dm_policy open). Fix = per-sender allowlist on group traffic, deny by default, tool-less agent for untrusted turns, caller identity + ownership check on subagent run-control routes. v0.7.2 release notes only say 'small fix' and do not mention the CVE; the advisory is the source. No exploitation or PoC found; X chatter is only a LinuxSecurity commentary post."},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/#CVE-2026-112380","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","severity":null,"published_at":"2026-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:16+00:00","fetched_at":"2026-10-24T19:28:16+00:00","note":"AWS: CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew"}],"documents":[{"id":1556,"url":"https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc","title":"GHSA-x4jf-p42g-q3hc Missing authorization in the WhatsApp channel in Kiro Crew","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1557,"url":"https://aws.amazon.com/security/security-bulletins/2026-140-aws/","title":"AWS bulletin 2026-140-AWS CVE-2026-112380","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1558,"url":"https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2","title":"Kiro Crew v0.7.2 release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1775,"url":"https://x.com/lnxsec/status/2113605614676902023","title":"LinuxSecurity on Kiro Crew flaw","kind":"post","source":"analyst","text":"@lnxsec (LinuxSecurity, 4583 followers) · likes 1 reposts 0\nBeing allowed into a conversation is not the same as being authorized to act through it. That distinction becomes dangerous when an AI agent can execute commands on a Linux host. In the Kiro Crew flaw, a member of an allowed WhatsApp group could potentially direct a helper...","published_at":"2026-10-23T00:00:00+00:00","relation":"discussion","confidence":null,"note":null},{"id":2949,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","title":"AWS: CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew","kind":"advisory","source":"lab","text":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\n### CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\nBulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT\n\nDescription:\n\nKiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine.\n\nWe identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subagent run-control endpoints. In certain configurations where a WhatsApp group was added to an operator's allowed groups, or where the direct-message policy was set to open, a member of that WhatsApp group could send instructions to another session's subagent. The subagent then executed those instructions on the operator's machine under that session's approval policy, and the resulting audit trail was attributed to the operator rather than the actual sender.\n\nThe default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, so a group that is not explicitly listed is dropped before dispatch.\n\nImpacted versions: >=0.4.0 AND <0.7.2\n\nResolution:\n\nThis issue has been addressed in Kiro Crew version 0.7.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The fix (PR #14338) makes WhatsApp group traffic subject to the same per-user allowlist as direct messages (deny by default), runs untrusted turns on a dedicated tool-less agent so the untrusted flag no longer depends on a permission prompt, and requires a verified caller identity with an ownership check on every subagent run-control route.\n\nWorkarounds:\n\nRemove every entry from whatsapp.groups and keep whatsapp.dm_policy at self (the default). With no listed group, group traffic is dropped before any dispatch. Alternatively, disable the WhatsApp channel until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-112380\n- GHSA-x4jf-p42g-q3hc\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-20T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}