CVE-2026-112380
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is…
- Risk score
- 66/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A missing authorization flaw in Kiro Crew's WhatsApp group channel allows a remote actor to control other agent sessions and execute arbitrary commands. An attacker could exploit this to gain high impact and high confidence.
- Affected
- {'product': 'Kiro Crew', 'version': 'all versions prior to 0.7.2'}
- Fix
- Upgrade to version 0.7.2
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
References
Original description
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.
Last activity 20 Oct 2026. Patch Forecast updates every hour.