Executive Summary
A vulnerability in IntentKit through version 2.6.3 allows an unauthenticated attacker to bypass authorization and execute owner-only state-changing tools. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Affected users should update IntentKit to a version beyond 2.6.3.
Technical Analysis
The vulnerability, tracked as CVE-2026-76066, is an authorization bypass issue in IntentKit. The executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware. This allows owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread. This allows the attacker to achieve unauthorized execution of owner-restricted capabilities, potentially leading to high integrity impact.
Impact Assessment
The vulnerability affects IntentKit version 2.6.3 and earlier. An attacker can achieve high integrity impact, potentially leading to unauthorized execution of owner-restricted capabilities. The CVSS score for this vulnerability is 7.5, indicating a HIGH severity level.
Recommended Actions
To mitigate this vulnerability, users should update IntentKit to a version beyond 2.6.3. Additionally, implement proper input validation and authentication mechanisms to prevent unauthorized access.
Sources
- National Vulnerability Database (NVD)
-
[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-76066