CVE-2026-76066
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Remote, unauthenticated callers can trigger restricted owner-only actions like wallet transfers, agent calls, or posting without approval. They only need access via Web, API, Telegram, or Twitter interfaces to supply de-advertised tool names or replay checkpoint data.
Root cause
The executor checks requested tool calls against the global tool registry instead of the request-scoped, narrowed tool set enforced by ToolBindingMiddleware.
Affected systems
IntentKit through 2.6.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade to a version newer than 2.6.3 once available; if patching must wait, disable or remove sensitive tools (like wallet transfers and posting) from the global registry in shared or public-facing contexts.
$ pip install --upgrade intentkitAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.