AWS Kiro Crew 0.7.2 Fixes WhatsApp Cross-Session Authorization Flaw
Tech GuruQuick Answer
AWS published 2026-140-AWS for a Kiro Crew WhatsApp authorization flaw affecting versions 0.4.0 through 0.7.1 under specific non-default settings. Update to 0.7.2 or later, or remove groups and restrict direct messages while validating session isolation and prior tool activity.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Kiro Crew versions, WhatsApp configuration, operator hosts, enabled tools, sessions, and credentials; determine whether groups or open direct messages made the flaw applicable; update to 0.7.2 or later or disable/restrict the channel; validate isolation; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Kiro Crew WhatsApp channel |
|---|---|
| Advisory | 2026-140-AWS |
| CVE | CVE-2026-112380 |
| Authoritative release date | 2026-10-20 20:00:00 UTC |
| Authority revision date | 2026-10-20 20:00:00 UTC |
| Affected versions | Kiro Crew 0.4.0 through 0.7.1 when a WhatsApp group is configured or the direct-message policy is set to open; the default configuration is not affected. |
| Fixed version | Kiro Crew 0.7.2 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by AWS; no exploitation claim is inferred. |
What Changed
AWS fixed missing authorization in Kiro Crew's WhatsApp channel. Under non-default group or open-direct-message configuration, a member could direct a different session's subagent and cause tools to run on the operator's machine.
What To Validate Now
- Inventory. Identify Kiro Crew installations, exact versions, WhatsApp group configuration, direct-message policy, operator hosts, enabled tools, session owners, and accessible credentials or data.
- Establish applicability. Treat versions 0.4.0 through 0.7.1 as affected only when WhatsApp groups are configured or whatsapp.dm_policy is open; verify configuration rather than inferring exposure from version alone.
- Remediate. Upgrade to Kiro Crew 0.7.2 or later. Until then, remove whatsapp.groups, keep whatsapp.dm_policy set to self, or disable the WhatsApp channel.
- Validate. Confirm the resulting version and channel policy, verify session separation with representative messages, review prior tool activity, and rotate or contain credentials if unauthorized execution is suspected.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The default Kiro Crew configuration is not affected. Do not infer applicability from the product version alone: verify whatsapp.groups and whatsapp.dm_policy. AWS did not publish a CVSS score, severity, or exploitation statement.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
