Key points
- CVE-2026-112380 affects Kiro Crew versions 0.4.0 through 0.7.1.
- Attackers can execute arbitrary commands on the host machine via WhatsApp.
- AWS released version 0.7.2 to fix the missing authorization issue.
Amazon Kiro Crew versions 0.4.0 through 0.7.1 contain a critical authorization flaw that allows remote attackers to execute commands on the host machine. The issue, tracked as CVE-2026-112380, has a CVSS score of 9.9. AWS released version 0.7.2 on October 20, 2026, to address the vulnerability in this open-source AI agent.
In plain English
Kiro Crew is an AI agent that runs tools on your computer. It can be controlled via a web dashboard, command line, or WhatsApp. The flaw exists in the WhatsApp channel. If an operator configures a WhatsApp group as allowed, or sets direct messages to open, any member of that group can send instructions. These instructions are executed on the operator's machine under the operator's approval policy.
The background
The National Vulnerability Database lists the weakness as missing authorization. According to AWS, the subagent executes instructions from group members on the operator's machine. The audit trail attributes these actions to the operator, not the actual sender. The default configuration is not affected because group lists are empty and direct message policies default to self.
What changes now
AWS released version 0.7.2 to fix the issue. The update makes WhatsApp group traffic subject to per-user allowlists. It runs untrusted turns on a dedicated tool-less agent. It also requires verified caller identity with an ownership check on every subagent run-control route. Users should upgrade to this version immediately.
Who needs to act first
Teams usually prioritize systems exposed to external messaging channels. Check whether your deployment uses WhatsApp groups or open direct message policies. If so, isolate these systems from critical operations until patched. Test the upgrade in a non-production environment first to ensure compatibility. Back up configuration files before applying changes. Monitor logs for unusual activity during the transition period.
What to do and how to stay safe: AWS
- Upgrade Kiro Crew to version 0.7.2 or later to apply the official fix.
- Remove all entries from the whatsapp.groups configuration setting immediately.
- Ensure the whatsapp.dm_policy setting remains at the default value of self.
- Disable the WhatsApp channel entirely if an immediate upgrade is not possible.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Kiro Crew are affected by CVE-2026-112380?
Versions 0.4.0 through 0.7.1 are affected by this authorization flaw.
Is the default configuration of Kiro Crew vulnerable?
No, the default configuration is not affected because groups are empty and DM policy is self.
How does AWS recommend mitigating the issue before patching?
AWS recommends removing entries from whatsapp.groups and keeping whatsapp.dm_policy at self.
