Kiro Crew CVE-2026-112380: Critical Missing Authorization in WhatsApp Channel Enables Remote Command Execution

Amazon Kiro Crew contains a critical authorization vulnerability that permits remote actors to execute arbitrary commands on host machines. The flaw, tracked as CVE-2026-112380, exists in the WhatsApp integration channel. According to AWS Security Bulletins, the issue affects configurations where operators allow specific WhatsApp groups or set direct-message policies to open.

Root cause

The vulnerability stems from missing authorization checks in the internal subagent run-control endpoints. AWS reports that when a WhatsApp group was added to an operator's allowed list, or if the direct-message policy was open, group members could send instructions to other sessions' subagents. The system failed to verify the caller's identity against the correct allowlist for group traffic, treating untrusted input as authorized commands.

Attack path

An attacker needs only to be a member of a WhatsApp group configured in an operator's Kiro Crew settings. Once inside, the member sends instructions via the group chat. The subagent executes these instructions on the operator's machine under that session's approval policy. Crucially, the resulting audit trail attributes the action to the operator rather than the actual sender, hiding the source of the command execution.

Affected versions

• Amazon Kiro Crew versions greater than or equal to 0.4.0
• Amazon Kiro Crew versions less than 0.7.2
• Default configurations are not affected because whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, causing unlisted group traffic to be dropped before dispatch.

Mitigation

• Upgrade Amazon Kiro Crew to version 0.7.2, which includes the fix for CVE-2026-112380.
• Remove every entry from the whatsapp.groups configuration setting to ensure no groups are explicitly allowed.
• Ensure the whatsapp.dm_policy setting remains at its default value of self to restrict direct messages.
• Disable the WhatsApp channel entirely until the upgrade is successfully applied and verified.

Signals worth monitoring

Security teams should monitor for unusual command executions originating from messaging integrations. Check audit logs for actions attributed to operators that do not match their typical behavior or location. Look for subagent activity triggered by group messages rather than direct commands. Verify that tool execution correlates with explicit user approval events. Alert on any discrepancy between the authenticated user identity and the source of the instruction.

What to do and how to stay safe: Amazon

• Review current Kiro Crew configurations to ensure whatsapp.groups is empty and whatsapp.dm_policy is set to self.
• Upgrade to version 0.7.2 as soon as possible to apply the vendor-provided authorization fixes.
• Monitor audit logs for command executions that lack corresponding direct-user approval events.
• Disable the WhatsApp channel if immediate upgrading is not feasible to block the attack vector.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112380?

The vulnerability has a CVSS score of 9.9, which is classified as critical.

Does the default configuration protect against this flaw?

Yes, the default configuration is not affected because it drops group traffic before dispatch unless groups are explicitly listed.

How does the fix in version 0.7.2 work?

The fix subjects WhatsApp group traffic to per-user allowlists, runs untrusted turns on a dedicated tool-less agent, and requires verified caller identity with ownership checks.