AWS Patches Critical Authorization Flaw in Kiro Crew WhatsApp Channel

Amazon Web Services released a security bulletin on October 20, 2026, addressing a critical authorization flaw in Kiro Crew, an open-source personal AI agent. The issue, identified as CVE-2026-112380, exists in the WhatsApp channel and internal subagent run-control endpoints. According to the AWS Security Bulletin, the vulnerability allows remote actors who are members of an operator-configured WhatsApp group to send instructions to another session's subagent.

The National Vulnerability Database assigned a CVSS score of 9.9 to this vulnerability, classifying it as critical. The flaw stems from missing authorization checks, categorized under CWE-862 and CWE-863. In specific configurations where an operator added a WhatsApp group to their allowed list or set the direct-message policy to open, group members could bypass intended restrictions. The subagent would then execute these instructions on the operator's machine under that session's approval policy.

Context and Background

Kiro Crew is designed to run tools on an operator's machine and can be accessed via a web dashboard, a command-line interface, or messaging channels like WhatsApp. The security bulletin notes that the resulting audit trail from these unauthorized actions was attributed to the operator rather than the actual sender of the message. This misattribution obscures the true source of the command execution. The default configuration for Kiro Crew is not affected by this issue because the whatsapp.groups setting defaults to empty and the whatsapp.dm_policy defaults to self.

According to the advisory, when no group is explicitly listed, group traffic is dropped before dispatch. The vulnerability only manifests when users deviate from these defaults by explicitly adding groups or opening the direct-message policy. The bulletin emphasizes that the fix in version 0.7.2 makes WhatsApp group traffic subject to the same per-user allowlist as direct messages, effectively denying access by default.

Who Is Affected

Users running Kiro Crew versions 0.4.0 through 0.7.1 are impacted by this vulnerability. The AWS Security Bulletin explicitly states that any version greater than or equal to 0.4.0 and less than 0.7.2 is affected. Operators who have configured their Kiro Crew instance to accept messages from WhatsApp groups are at the highest risk. Those using the default settings, where no groups are listed and the direct-message policy is set to self, are not vulnerable to this specific attack vector.

The issue requires a remote actor to be a member of the specific WhatsApp group configured in the operator's settings. The bulletin does not indicate that the flaw is being exploited in the wild, but the potential for arbitrary command execution on the host machine represents a severe risk to system integrity.

What should you do?

AWS recommends upgrading to Kiro Crew version 0.7.2 immediately to remediate the issue. The update includes pull request #14338, which introduces several security improvements. These changes ensure that untrusted turns run on a dedicated tool-less agent, removing the dependency on permission prompts for the untrusted flag. Additionally, the fix requires a verified caller identity with an ownership check on every subagent run-control route.

For users who cannot upgrade immediately, the advisory suggests removing every entry from the whatsapp.groups configuration and keeping the whatsapp.dm_policy at self. This ensures that any group traffic is dropped before dispatch. Alternatively, users can disable the WhatsApp channel entirely until the upgrade is applied. The bulletin also advises ensuring that any forked or derivative code is patched to incorporate these new fixes.