CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...

CVE-2026-112380

The Kiro Crew software is vulnerable to missing authorization in the WhatsApp group channel. This flaw allows a remote actor who is a member of an operator-configured WhatsApp group to send messages that take control of the operator's other agent sessions. Consequently, the attacker may be able t...