CVE-2026-112380 Amazon CVE debrief

Who should care

Defenders responsible for Kiro Crew instances, particularly those using WhatsApp group channels, should assess exposure and prioritize remediation. This includes reviewing the vendor's advisory, verifying affected versions, and assessing the potential impact on their environment. Additionally, defenders should consider the potential operational impacts, including potential remote code execution and agent session compromise.

Why it matters

This critical vulnerability in Kiro Crew's WhatsApp channel requires immediate attention from defenders to prevent potential remote code execution and agent session compromise.

• Potential remote code execution
• Agent session control compromise
• Command execution on host system

Technical summary

Missing authorization in the WhatsApp group channel in Kiro Crew allows remote actors to control agent sessions and execute arbitrary commands. The vulnerability is caused by a lack of proper authorization checks in the WhatsApp group channel, which could allow a remote actor to send malicious commands to the host running Kiro Crew. Defenders should prioritize upgrading to version 0.7.2 and assess the exposure of WhatsApp group channels to prevent potential exploitation of this vulnerability. The vulnerability's technical details are based on the CVE record and source item, which provide limited information on affected versions and exploitation.

Defensive priority

Defenders should prioritize upgrading to version 0.7.2 and assess exposure of WhatsApp group channels.

Recommended defensive actions

• Upgrade to version 0.7.2
• Assess exposure of WhatsApp group channels
• Verify inventory of Kiro Crew instances
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and its potential impact. However, additional information on affected versions and exploitation is limited. Defenders should verify the affected versions and review the vendor's advisory for specific guidance. The WhatsApp group channel's configuration and the operator's environment may also impact the vulnerability's exploitability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.