EUVD-2026-101810
GHSA-6qqv-mhm9-qrfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public agent via WEB/API/Telegram
-
DeliveryDeliver de-advertised tool name via prompt injection or thread replay
-
ExploitExecutor checks full registry not narrowed advertisement
-
ExecutionOwner-only tool runs without approval gate
-
ImpactUnauthorized wallet transfer or post executed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable when an IntentKit agent (≤2.6.3) exposes owner-only state-changing tools (wallet transfer, posting, memory-write, call-agent) and is reachable in WEB, API, TWITTER, or TELEGRAM contexts. The attacker must supply the EXACT de-advertised tool name and valid arguments, delivered either through an indirect prompt-injection channel the agent ingests or by replaying checkpoint and history data on a reused thread. The core defect is that the executor authorizes calls against the full tool registry instead of the ToolBindingMiddleware per-request narrowed advertisement, and no human-in-the-loop or approval gate intervenes. Limiting factors: the caller needs knowledge of the specific restricted tool names and a working injection/replay vector, and the owner-restricted tools must actually be registered on the targeted agent; no authentication is required (PR:N) and no user interaction by a victim is needed (UI:N). |
| Impact | The CVSS 4.0 base score of 8.7 (HIGH) is driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with a high integrity impact (VI:H) and no confidentiality or availability impact (VC:N/VA:N). This is consistent with CWE-862 (Missing Authorization): the real-world damage is unauthorized state-changing actions (wallet transfer, posting, memory-write, call-agent), not data theft or outage, so the single-dimension integrity hit explains the score. Exploitation signals are mixed and mostly ABSENT: there is NO CISA KEV listing, NO EPSS probability supplied in the input, and NO public PoC referenced - so this is 'no public exploit identified at time of analysis,' NOT confirmed active exploitation. Mitigating the raw PR:N rating, the attack still requires the caller to know the exact de-advertised tool name and to control an indirect-prompt-injection vector or a reusable thread's checkpoint/history, which raises practical difficulty above a trivial one-shot RCE. Net: a credible, vendor-reported (VulnCheck) authorization-bypass priority for anyone actually running IntentKit with owner-only tools exposed, but its blast radius is bounded by the niche deployment footprint of the product rather than being an internet-wide mass-exploitation event. EPSS is not provided, so widespread-vs-targeted likelihood cannot be quantified from the given data. |
| Exploit ScenarioDerived | A public user interacting with an IntentKit agent over WEB, API, Twitter, or Telegram embeds the exact name and arguments of an owner-only tool (e.g., wallet transfer) inside content that reaches the agent as indirect prompt injection, or replays saved checkpoint/history on a reused thread. Because the executor validates the call against the full tool registry instead of the per-request narrowed advertisement from ToolBindingMiddleware, the owner-restricted tool runs with no human-in-the-loop or approval gate. No public exploit code is identified at time of analysis, but the attack is unauthenticated (PR:N) and low-complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-76066; IntentKit through 2.6.3 remains affected, so check https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode and https://www.lasso.security/vulnerability-database/cve-2026-76066 for an updated fixed version before upgrading. Until a patched release is available, the most effective compensating control is to remove or disable the owner-only state-changing tools (wallet transfer, posting, memory-write, call-agent) from every agent that can receive untrusted input - the trade-off is loss of those capabilities, but it eliminates the exploit primitive entirely, whereas leaving them registered preserves the vulnerability. Where the tools must stay enabled, move them behind an explicit out-of-band human approval step that the executor cannot bypass, or enforce authorization inside the executor against the ToolBindingMiddleware narrowed set rather than the full registry if you maintain a fork; note that approval gates implemented inside the same agent loop that processes injected content may themselves be reachable. Reduce the delivery surface by restricting WEB and API agent endpoints to trusted networks or authenticated operators and by locking Twitter and Telegram integrations to an allowlist of known accounts, accepting that this does not protect against content injected through legitimately allowed channels. Invalidate or rotate conversation checkpoints and thread history, and disable thread reuse for public-facing agents, so that replayed checkpoint data cannot re-invoke de-advertised tools - this breaks long-lived conversation state as a side effect. Sanitize or strip tool-call-like structures from any untrusted content fed into the agent (web pages, messages, documents) to blunt indirect prompt injection, and monitor agent logs for tool invocations whose names were not present in that request's advertised tool list, which is the clearest detection signal available for this defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IntentKit is an open-source agent framework (Crestal Network) that binds language-model agents to a set of callable tools and executes them on behalf of a user. Its intended security model is layered: ToolBindingMiddleware computes a per-request, narrowed advertisement of tools that are appropriate for the current caller and conversation context, hiding owner-only capabilities from the model, while the executor is responsible for authorizing the actual call. CVE-2026-76066 is a classic CWE-862 (Missing Authorization) failure in which that second layer does not enforce the same policy as the first: the executor validates incoming tool invocations against the full registry rather than the narrowed set, so any tool name present in the registry can be invoked regardless of whether it was advertised for that request. The consequence is that privileged, state-changing tools - wallet transfer, posting, memory-write, and call-agent - can be triggered by an unauthenticated or public caller (CVSS 4.0 vector shows PR:N/UI:N, and the independent assessment confirms no authentication and no victim interaction). Delivery is indirect: the attacker either injects the exact de-advertised tool name and arguments through content the agent ingests (indirect prompt injection) or replays checkpoint and history data on a reused thread so that previously recorded tool invocations are re-executed. Because agent checkpoints and conversation history are treated as trusted state, replay re-enters the vulnerable executor path without any approval gate. The affected component is tracked as CPE cpe:2.3:a:crestalnetwork:intentkit across all versions up to and including 2.6.3 (EUVD records the range as intentkit 0 through 2.6.3). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the impact is confined to integrity - unauthorized actions are performed, but no confidentiality or availability loss is expected from the primitive itself.
Know when Intentkit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Public unauthenticated caller triggers owner tools remotely (AV:N/PR:N/AC:L/UI:N); impact is unauthorized state-changing execution so I:H, with no data disclosure (C:N) or outage (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Executive ViewAI
IntentKit, an autonomous agent framework, contains a missing-authorization flaw (CVE-2026-76066, CVSS 8.7) that allows a remote attacker to invoke owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on any agent exposed through web, API, Twitter, or Telegram channels. Those actions execute with the agent owner's privileges and no human approval step, so the core exposure is integrity and financial control: unauthorized fund movement and public statements issued in the organization's name. Leadership should treat this as a high-priority issue wherever IntentKit agents hold wallet credentials or publish to brand-owned accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable public channel bindings (web, API, Twitter/X, Telegram) for IntentKit agents at or below 2.6.3; remove owner-only state-changing tools (wallet transfer, social posting, memory write, agent-to-agent calls) from the active registry unless strictly required; enforce a per-request tool allowlist at the executor layer instead of authorizing against the complete tool registry; require human-in-the-loop approval for all state-changing tool calls; invalidate thread identifiers and purge checkpoint/history data to defeat replay on reused threads; segment and rotate wallet keys and social platform credentials held by agents; apply egress filtering so agents cannot reach financial or publishing endpoints they are not authorized to use; and monitor agent logs for unexpected or de-advertised tool invocations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB