{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aintentkitintentkit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:intentkit:intentkit:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-76066"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IntentKit (\u003c= 2.6.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IntentKit"],"content_html":"\u003cp\u003eIntentKit versions 2.6.3 and earlier are affected by an authorization bypass vulnerability identified as CVE-2026-76066. The vulnerability stems from a flaw in the executor component, which validates tool calls against the global tool registry rather than the narrowed tool advertisement enforced by the ToolBindingMiddleware. This failure to validate against per-request constraints allows unauthenticated or unauthorized callers in web, API, Twitter, or Telegram contexts to invoke sensitive, state-changing tools.\u003c/p\u003e\n\u003cp\u003eThe scope of the impact includes owner-only capabilities such as financial wallet transfers, arbitrary memory writes, and unauthorized agent calls. By providing the exact tool name and associated arguments - potentially via indirect prompt injection or by replaying previously captured session history data - an actor can force the execution of restricted tools without requiring human-in-the-loop approval. This bypasses the intended security boundary of the framework, posing a high risk to data integrity and financial assets managed by the agent.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized execution of sensitive agent functions. In environments where IntentKit manages financial accounts or persistent memory, this can lead to unauthorized asset transfers or data manipulation. The vulnerability is exploitable by public callers, meaning any integrated interface exposing the IntentKit executor is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade IntentKit to a version beyond 2.6.3 as soon as a patch is available.\u003c/li\u003e\n\u003cli\u003eAudit application logs for calls to privileged state-changing tools (such as wallet transfer or memory-write) originating from public or untrusted contexts that do not coincide with expected user session checkpoints.\u003c/li\u003e\n\u003cli\u003eImplement stricter server-side validation of tool call arguments to ensure they conform to the intended scope defined by ToolBindingMiddleware, rather than relying solely on the framework's internal registry validation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T02:34:27Z","date_published":"2026-10-15T02:34:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-intentkit-auth-bypass/","summary":"IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.","title":"Authorization Bypass in IntentKit via Tool Registry Misvalidation","url":"https://feed.craftedsignal.io/briefs/2026-10-intentkit-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:intentkit:intentkit:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}