--- title: "CVE-2026-112380: Kiro Crew - Broken Access Control" description: "Kiro Crew contains a broken access control caused by missing authorization in the WhatsApp group channel, letting remote group members execute arbitrary commands on the host, exploit requires membership in the operator-configured WhatsApp group." url: https://panop.io/threat-heartbeat/CVE-2026-112380/ --- # CVE-2026-112380 Kiro Crew - Broken Access Control Kiro Crew contains a broken access control caused by missing authorization in the WhatsApp group channel, letting remote group members execute arbitrary commands on the host, exploit requires membership in the operator-configured WhatsApp group. CVSS base score 9.9 /10 Critical CISA KEV Not listed Public exploit None known Authentication Required [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-112380) ## Details Type Broken Access Control Impact Remote Code Execution CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Published 20 October 2026 Updated 21 October 2026 Weakness [CWE-862](https://cwe.mitre.org/data/definitions/862.html) ## Vendor fix Upgrade to version 0.7.2. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-112380](https://nvd.nist.gov/vuln/detail/CVE-2026-112380) - [https://aws.amazon.com/security/security-bulletins/2026-140-aws/](https://aws.amazon.com/security/security-bulletins/2026-140-aws/) - [https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2](https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2) - [https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc](https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)