CVE-2026-112380 in Kiro Crew
Summary
by MITRE • 10/20/2026
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in the Kiro Crew software represents a critical failure in access control mechanisms within its WhatsApp integration module. Specifically, the application fails to enforce proper authorization checks when processing commands received through operator-configured WhatsApp group channels. This architectural flaw allows any participant who is added as a member of such a group to interact with the system beyond their intended permissions. In a typical secure implementation, only authenticated and authorized operators should have the ability to issue control commands that affect agent sessions or execute code on host systems. However, due to this missing authorization check, the boundary between untrusted participants and trusted administrative functions is effectively dissolved within the context of these group communications.
From a technical perspective, the flaw lies in the validation logic that processes incoming messages from WhatsApp groups. The application likely assumes that membership in an operator-defined group implies trust or authority, without verifying whether the specific user sending the command holds valid credentials for such actions. This oversight enables a remote actor to inject malicious payloads disguised as standard chat messages. Once these messages are parsed by the Kiro Crew backend, they are executed with the privileges of the running service account. Consequently, an attacker who gains membership in one of these groups can manipulate agent sessions and execute arbitrary commands on the underlying host operating system. This capability transforms a simple messaging channel into a remote code execution vector, bypassing traditional network perimeter defenses that might otherwise restrict access to the management interface.
The operational impact of this vulnerability is severe, as it compromises both confidentiality and integrity of the managed infrastructure. An adversary can use this entry point to escalate privileges, exfiltrate sensitive data from compromised hosts, or establish persistent backdoors within the environment. Furthermore, because WhatsApp groups are often used for collaborative communication, an attacker might exploit social engineering tactics to gain membership in these groups more easily than through direct technical exploitation of network services. The ability to control other agent sessions also implies that lateral movement across multiple systems managed by Kiro Crew becomes feasible, potentially leading to a widespread compromise of the entire operational technology or IT infrastructure dependent on this tool.
This issue aligns with CWE-284, which describes Improper Access Control, where insufficient restrictions are applied to authenticate users or validate permissions before allowing access to resources. Additionally, from an offensive security perspective, it maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059, as well as potential lateral movement via remote services if the executed commands facilitate further propagation. The vulnerability highlights a common pitfall in integrating third-party messaging platforms with sensitive operational tools: assuming that platform-level group membership equates to application-level authorization without implementing granular permission checks within the software itself.
To remediate this critical security flaw, users must upgrade Kiro Crew to version 0.7.2 or later, where these access control mechanisms have been corrected. In addition to applying the patch, organizations should review their WhatsApp group configurations to ensure that only verified and necessary personnel are added as members. Implementing strict membership policies and regularly auditing who has access to operator-configured groups can mitigate the risk of unauthorized actors gaining entry. Furthermore, adopting a principle of least privilege for all service accounts running Kiro Crew will limit the potential damage if such vulnerabilities were present in other components or future versions. Regular security assessments and penetration testing focused on integration points with external communication platforms are recommended to identify similar authorization gaps before they can be exploited by malicious actors.