Threat
CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew
Publication date unknown · Discovered amazon.com
Page published
Publication date unknown · First observed: 9 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
Kiro Crew deployments using the WhatsApp channel warrant review for an authorization weakness, although the supplied excerpt does not establish which capabilities an unauthorized user could access.
AWS bulletin 2026-140-AWS identifies CVE-2026-112380 as a missing-authorization vulnerability in Kiro Crew’s WhatsApp channel. The supplied excerpt ends before the technical description, leaving affected versions, exploitation requirements, impact, and remediation unconfirmed.