Kiro Crew (< 0.7.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kiro-crew--0.7.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 21:54:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKiro Crew: Missing authorization in WhatsApp group channel (CVE-2026-112380)https://feed.craftedsignal.io/briefs/2026-10-kiro-crew-auth-bypass/Tue, 20 Oct 2026 21:54:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kiro-crew-auth-bypass/A missing authorization vulnerability in the Kiro Crew WhatsApp integration allows remote attackers who are group members to hijack agent sessions and execute arbitrary commands on the host system.Kiro Crew contains a critical missing authorization vulnerability (CVE-2026-112380) within its WhatsApp group channel integration. An attacker who is already a participant in an operator-configured WhatsApp group can leverage this flaw to send specifically crafted messages that the Kiro Crew application processes without proper authorization checks. This enables the remote attacker to hijack other agent sessions managed by the software and execute arbitrary commands on the underlying host operating system. This vulnerability poses a severe risk, as it allows for full command execution and session control from within an existing communication channel. Organizations utilizing Kiro Crew are advised to update to version 0.7.2 or later immediately to mitigate this exposure.

Attack Chain

  1. The operator configures a WhatsApp group channel for Kiro Crew agent communication.
  2. The attacker gains membership into the operator-configured WhatsApp group.
  3. The attacker identifies the command-parsing logic within the Kiro Crew WhatsApp integration.
  4. The attacker crafts a malicious message containing command sequences or session control instructions.
  5. The attacker sends the crafted message to the WhatsApp group.
  6. The Kiro Crew application parses the message from the group channel.
  7. The application fails to perform authorization validation on the message sender or the command content.
  8. The host system executes the arbitrary commands or performs session hijacking actions as authorized by the Kiro Crew process.

Impact

Successful exploitation of CVE-2026-112380 results in unauthorized command execution on the host machine and complete takeover of active agent sessions. This effectively grants an attacker full control over the Kiro Crew environment and potentially the underlying host, allowing for data exfiltration, lateral movement, and further persistent access.

Recommendation

  1. Upgrade Kiro Crew to version 0.7.2 or later across all instances immediately to patch CVE-2026-112380.
  2. Audit current WhatsApp group memberships configured within Kiro Crew to ensure only authorized entities have access to the communication channels monitored by the software.
  3. Review audit logs for any unexpected command executions or session handovers originating from the WhatsApp integration module.
]]>criticaladvisoryvulnerabilityrceauthentication-bypass