Intentkit
Monthly
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.