CVE-2026-112380

Name of the Vulnerable Software and Affected Versions Kiro Crew versions prior to 0.7.2

Description Missing authorization in the WhatsApp group channel allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions of the operator. This occurs because the WhatsApp channel could route instructions from group members into another session's subagent under its approval policy, potentially leading to the execution of arbitrary commands on the host running the software via messages sent to the group.

Recommendations Upgrade to version 0.7.2. Validate sender identity and session ownership.