Kiro Crew WhatsApp Authorization Flaw Needs Your Attention

Kiro Crew versions 0.4.0 through 0.7.2 have a nasty authorization bug in the WhatsApp channel (CVE-2026-112380). If you've explicitly configured WhatsApp groups or set open direct-message policies, someone in those groups could hijack another session's subagent and run commands on your machine. The good news? Default configs are safe. If you're using custom WhatsApp settings, upgrade to 0.7.2 immediately.