Cheshire Cat Ai
Monthly
Authentication bypass in Cheshire Cat AI up to version 1.9.2 allows remote unauthenticated attackers to manipulate the `user_id` argument within the `_authorize_http_key` function to circumvent HTTP API key validation entirely. Any publicly exposed Cheshire Cat AI instance is at risk of unauthorized access to its AI agent API, enabling arbitrary interaction with the agent without valid credentials. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1137, and the project maintainers had not responded to the disclosure at time of writing; no patch is available.
Authentication bypass in Cheshire Cat AI up to version 1.9.2 allows remote unauthenticated attackers to manipulate the `user_id` argument within the `_authorize_http_key` function to circumvent HTTP API key validation entirely. Any publicly exposed Cheshire Cat AI instance is at risk of unauthorized access to its AI agent API, enabling arbitrary interaction with the agent without valid credentials. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1137, and the project maintainers had not responded to the disclosure at time of writing; no patch is available.