CVE-2026-112380 vulnerability in Amazon Products
Published on October 20, 2026
Missing authorization in the WhatsApp channel in Kiro Crew
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.
Vulnerability Analysis
CVE-2026-112380 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Types
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-112380 has been classified to as an AuthZ vulnerability or weakness.
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-112380 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-112380
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Amazon Kiro Crew. Just hit a watch button to start following.