{"id":"GHSA-x4jf-p42g-q3hc","kind":"vulnerability","aliases":["GHSA-x4jf-p42g-q3hc"],"related":[],"title":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew","description":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\n### CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\nBulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT\n\nDescription:\n\nKiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine.\n\nWe identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subagent run-control endpoints. In certain configurations where a WhatsApp group was added to an operator's allowed groups, or where the direct-message policy was set to open, a member of that WhatsApp group could send instructions to another session's subagent. The subagent then executed those instructions on the operator's machine under that session's approval policy, and the resulting audit trail was attributed to the operator rather than the actual sender.\n\nThe default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, so a group that is not explicitly listed is dropped before dispatch.\n\nImpacted versions: >=0.4.0 AND <0.7.2\n\nResolution:\n\nThis issue has been addressed in Kiro Crew version 0.7.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The fix (PR #14338) makes WhatsApp group traffic subject to the same per-user allowlist as direct messages (deny by default), runs untrusted turns on a dedicated tool-less agent so the untrusted flag no longer depends on a permission prompt, and requires a verified caller identity with an ownership check on every subagent run-control route.\n\nWorkarounds:\n\nRemove every entry from whatsapp.groups and keep whatsapp.dm_policy at self (the default). With no listed group, group traffic is dropped before any dispatch. Alternatively, disable the WhatsApp channel until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-112380\n- GHSA-x4jf-p42g-q3hc\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Kiro Crew, an open-source personal AI agent that runs tools on the operator's machine, lacks authorization checks on its WhatsApp channel and subagent run-control endpoints. In non-default configurations, a WhatsApp group member can send instructions that a subagent executes on the operator's machine, with the audit trail attributed to the operator.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agent","ai-tooling","aws","kiro-crew","lab-disclosure","self-hosted","whatsapp"],"not_affected_if":["default-config","versions-0.7.2-or-later","whatsapp-disabled"],"how_to_check":"- Check the installed Kiro Crew version; affected versions are `>=0.4.0` and `<0.7.2`.\n- Inspect the Kiro Crew config for `whatsapp.groups` and confirm it has no entries.\n- Confirm `whatsapp.dm_policy` is set to `self` (the default), not `open`.","fix":"- Upgrade Kiro Crew to `0.7.2` or later.\n- Patch any forked or derivative code to include the fix from PR #14338.\n- Until upgraded, remove all entries from `whatsapp.groups` and keep `whatsapp.dm_policy` at `self`, or disable the WhatsApp channel.","status":"open","published_at":"2026-10-20T00:00:00+00:00","first_seen_at":"2026-10-24T19:28:16+00:00","triaged_at":"2026-10-25T05:08:16+00:00","updated_at":"2026-10-25T05:08:16+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T05:08:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kiro Crew to `0.7.2` or later.\n- Patch any forked or derivative code to include the fix from PR #14338.\n- Until upgraded, remove all entries from `whatsapp.groups` and keep `whatsapp.dm_policy` at `self`, or disable the WhatsApp channel.","reach":"internet","title":"Kiro Crew: WhatsApp group members can drive operator's subagent tools","impact":"high","summary":"Kiro Crew, an open-source personal AI agent that runs tools on the operator's machine, lacks authorization checks on its WhatsApp channel and subagent run-control endpoints. In non-default configurations, a WhatsApp group member can send instructions that a subagent executes on the operator's machine, with the audit trail attributed to the operator.","category":"ai-tooling","nicknames":[],"who_cares":["kiro-crew","whatsapp","ai-agent","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Group members run tools on operator's machine via subagent instructions","analyst_note":"","how_to_check":"- Check the installed Kiro Crew version; affected versions are `>=0.4.0` and `<0.7.2`.\n- Inspect the Kiro Crew config for `whatsapp.groups` and confirm it has no entries.\n- Confirm `whatsapp.dm_policy` is set to `self` (the default), not `open`.","needs_analyst":false,"not_affected_if":["default-config","whatsapp-disabled","versions-0.7.2-or-later"],"who_is_affected":"Only operators running Kiro Crew versions from 0.4.0 up to but not including 0.7.2 with the WhatsApp channel configured for groups or with the direct-message policy set to open. The default configuration is not affected, because unlisted groups are dropped before dispatch. Operators who run Kiro Crew only through the web dashboard or CLI, without WhatsApp, are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000773,"input_tokens":4117,"output_tokens":722,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112380':3A,101C,113C,182C,433C '-140':126C '-2026':2A,100C,112C,181C,432C '0.4.0':300C '0.7.2':302C,313C '00':139C '10/20/2026':137C '13':138C '14338':338C '2026':125C 'actual':268C 'add':206C 'address':308C 'affect':275C 'agent':25B,48B,152C,366C 'ai':24B,27B,47B,151C 'ai-ag':23B 'ai-tool':26B 'allow':211C 'allowlist':350C 'altern':420C 'anoth':234C 'appli':429C 'approv':253C 'attent':134C 'attribut':95B,261C 'audit':93B,258C 'author':5A,58B,103C,115C,184C 'aw':29B,127C,129C 'aws-security@amazon.com':441C 'bulletin':123C 'caller':382C 'certain':199C 'channel':9A,63B,107C,119C,165C,189C,424C 'check':59B,387C 'cli':162C 'code':327C 'concern':447C 'configur':74B,200C,272C 'content':130C 'control':68B,196C,393C 'could':230C 'crew':12A,32B,41B,110C,122C,144C,311C 'cve':1A,99C,111C,180C,431C 'dashboard':160C 'date':136C 'dedic':362C 'default':73B,271C,277C,283C,356C,408C 'deni':354C 'depend':373C 'deriv':326C 'descript':142C 'direct':217C,352C 'direct-messag':216C 'disabl':421C 'disclosur':35B 'dispatch':297C,419C 'drop':295C,416C 'email':440C 'empti':279C 'endpoint':69B,197C 'ensur':322C 'entri':398C 'everi':389C,397C 'execut':85B,241C 'explicit':292C 'fix':334C,336C 'flag':370C 'fork':324C 'ghsa':14A,19A,435C 'ghsa-x4jf-p42g-q3hc':13A,18A,434C 'group':77B,204C,212C,229C,288C,341C,412C,413C 'host':38B 'id':124C 'ident':383C 'identifi':179C 'impact':298C 'import':132C 'incorpor':331C 'instruct':81B,232C,243C 'intern':192C 'issu':185C,305C 'keep':402C 'kiro':11A,31B,40B,109C,121C,143C,310C 'kiro-crew':30B 'lab':34B 'lab-disclosur':33B 'lack':57B 'latest':319C 'less':365C 'list':293C,411C 'longer':372C 'machin':56B,90B,177C,248C 'make':339C 'member':78B,225C 'messag':164C,218C,353C 'miss':4A,102C,114C 'new':333C 'non':72B 'non-default':71B 'open':44B,148C,223C 'open-sourc':43B,147C 'oper':54B,88B,98B,175C,209C,246C,264C 'ownership':386C 'p42g':16A,21A,437C 'patch':329C 'pdt':141C 'per':348C 'per-us':347C 'permiss':376C 'person':46B,150C 'pleas':439C 'pm':140C 'polici':219C,254C,282C,404C 'pr':337C 'prompt':377C 'public':135C 'q3hc':17A,22A,438C 'question':445C 'rather':265C 'reach':156C 'recommend':315C 'refer':430C 'remov':396C 'requir':133C,379C 'resolut':303C 'result':257C 'rout':394C 'run':50B,67B,171C,195C,357C,392C 'run-control':66B,194C,391C 'scope':128C 'secur':444C 'self':37B,285C,406C 'self-host':36B 'send':80B,231C 'sender':269C 'session':235C,251C 'set':221C 'sourc':45B,149C 'subag':65B,84B,193C,237C,239C,390C 'subject':343C 'tool':28B,51B,172C,364C 'tool-less':363C 'traffic':342C,414C 'trail':94B,259C 'turn':359C 'type':131C 'untrust':358C,369C 'upgrad':316C,427C 'user':349C 'verifi':381C 'version':299C,312C,320C 'web':159C 'whatsapp':8A,39B,62B,76B,106C,118C,168C,188C,203C,228C,340C,423C 'whatsapp.dm':281C,403C 'whatsapp.groups':276C,400C 'workaround':395C 'x4jf':15A,20A,436C","nicknames":[],"mitigations":[],"who_affected":"Only operators running Kiro Crew versions from 0.4.0 up to but not including 0.7.2 with the WhatsApp channel configured for groups or with the direct-message policy set to open. The default configuration is not affected, because unlisted groups are dropped before dispatch. Operators who run Kiro Crew only through the web dashboard or CLI, without WhatsApp, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/#GHSA-x4jf-p42g-q3hc","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","severity":null,"published_at":"2026-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:16+00:00","fetched_at":"2026-10-24T19:28:16+00:00","note":"AWS: CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew"}],"documents":[{"id":1556,"url":"https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc","title":"GHSA-x4jf-p42g-q3hc Missing authorization in the WhatsApp channel in Kiro Crew","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2949,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-140-aws/","title":"AWS: CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew","kind":"advisory","source":"lab","text":"CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\n### CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew\n\nBulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT\n\nDescription:\n\nKiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine.\n\nWe identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subagent run-control endpoints. In certain configurations where a WhatsApp group was added to an operator's allowed groups, or where the direct-message policy was set to open, a member of that WhatsApp group could send instructions to another session's subagent. The subagent then executed those instructions on the operator's machine under that session's approval policy, and the resulting audit trail was attributed to the operator rather than the actual sender.\n\nThe default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, so a group that is not explicitly listed is dropped before dispatch.\n\nImpacted versions: >=0.4.0 AND <0.7.2\n\nResolution:\n\nThis issue has been addressed in Kiro Crew version 0.7.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. The fix (PR #14338) makes WhatsApp group traffic subject to the same per-user allowlist as direct messages (deny by default), runs untrusted turns on a dedicated tool-less agent so the untrusted flag no longer depends on a permission prompt, and requires a verified caller identity with an ownership check on every subagent run-control route.\n\nWorkarounds:\n\nRemove every entry from whatsapp.groups and keep whatsapp.dm_policy at self (the default). With no listed group, group traffic is dropped before any dispatch. Alternatively, disable the WhatsApp channel until the upgrade is applied.\n\nReferences:\n\n- CVE-2026-112380\n- GHSA-x4jf-p42g-q3hc\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-20T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}