{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akirokiro_crew/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kiro:kiro_crew:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-112380"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kiro Crew (\u003c 0.7.2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Kiro"],"content_html":"\u003cp\u003eKiro Crew contains a critical missing authorization vulnerability (CVE-2026-112380) within its WhatsApp group channel integration. An attacker who is already a participant in an operator-configured WhatsApp group can leverage this flaw to send specifically crafted messages that the Kiro Crew application processes without proper authorization checks. This enables the remote attacker to hijack other agent sessions managed by the software and execute arbitrary commands on the underlying host operating system. This vulnerability poses a severe risk, as it allows for full command execution and session control from within an existing communication channel. Organizations utilizing Kiro Crew are advised to update to version 0.7.2 or later immediately to mitigate this exposure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe operator configures a WhatsApp group channel for Kiro Crew agent communication.\u003c/li\u003e\n\u003cli\u003eThe attacker gains membership into the operator-configured WhatsApp group.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the command-parsing logic within the Kiro Crew WhatsApp integration.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious message containing command sequences or session control instructions.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted message to the WhatsApp group.\u003c/li\u003e\n\u003cli\u003eThe Kiro Crew application parses the message from the group channel.\u003c/li\u003e\n\u003cli\u003eThe application fails to perform authorization validation on the message sender or the command content.\u003c/li\u003e\n\u003cli\u003eThe host system executes the arbitrary commands or performs session hijacking actions as authorized by the Kiro Crew process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-112380 results in unauthorized command execution on the host machine and complete takeover of active agent sessions. This effectively grants an attacker full control over the Kiro Crew environment and potentially the underlying host, allowing for data exfiltration, lateral movement, and further persistent access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Kiro Crew to version 0.7.2 or later across all instances immediately to patch CVE-2026-112380.\u003c/li\u003e\n\u003cli\u003eAudit current WhatsApp group memberships configured within Kiro Crew to ensure only authorized entities have access to the communication channels monitored by the software.\u003c/li\u003e\n\u003cli\u003eReview audit logs for any unexpected command executions or session handovers originating from the WhatsApp integration module.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T21:54:09Z","date_published":"2026-10-20T21:54:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kiro-crew-auth-bypass/","summary":"A missing authorization vulnerability in the Kiro Crew WhatsApp integration allows remote attackers who are group members to hijack agent sessions and execute arbitrary commands on the host system.","title":"Kiro Crew: Missing authorization in WhatsApp group channel (CVE-2026-112380)","url":"https://feed.craftedsignal.io/briefs/2026-10-kiro-crew-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kiro:kiro_crew:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}