Kiro Crew EUVD-2026-105278

Exploitation requires that the operator has enabled and configured the WhatsApp group channel integration in Kiro Crew, and that the attacker is an existing member of that specific operator-configured WhatsApp group (reflected as AT:P and PR:L in the CVSS vector). It does not require any user interaction from the operator (UI:N) and is performed remotely over the network by sending messages to the group. Limiting factors: deployments that do not use the WhatsApp group integration are not exposed, and the attacker must first obtain membership in the target group, so the realistic attacker population is restricted to current or past group members or anyone who can compromise a member's WhatsApp account.

This is a genuine high-priority issue despite several missing exploitation signals. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) with full high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) yields a 9.0 Critical, driven by arbitrary command execution on the host - a worst-case technical impact. The key limiting signal is AT:P combined with PR:L: exploitation is not open to any anonymous internet actor but requires the attacker to already be a member of an operator-configured WhatsApp group, which is a meaningful barrier and argues against mass, automatable exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or widespread exploitation at this time - the risk is driven by impact severity and the plausibility of a malicious or compromised group member, not by observed in-the-wild activity. The signals are internally consistent (network vector, low added complexity, a specific precondition), with no contradiction between the vector and the description. Treat this as a prioritize-and-patch item for anyone running Kiro Crew with WhatsApp group integration, while recognizing the attack-requirement precondition narrows the realistic attacker population.

An operator configures Kiro Crew to take instructions from a WhatsApp group and adds several people to that group. A member of the group (or someone who gains access to a member's account) sends a crafted message that the missing-authorization flaw treats as a privileged command, letting them hijack the operator's other agent sessions and run arbitrary shell commands on the host. No public exploit code was identified at time of analysis, but the attack requires only sending messages to a group the attacker already belongs to.