CVE-2026-76066
Deferred Deferred - Pending Action

IntentKit Authorization Bypass via Tool Registry Validation Flaw

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-76066
EUVD
EUVD-2026-101810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crestalnetwork intentkit 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IntentKit through 2.6.3 has an authorization bypass flaw where the executor checks tool calls against the full tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware. This allows owner-only state-changing tools like wallet transfers or memory writes to execute without human approval or authentication in public contexts such as WEB, API, TWITTER, or TELEGRAM.

Detection Guidance

Check if IntentKit is running version 2.6.3 or earlier. Inspect logs for unauthorized tool executions, especially wallet transfers, posts, memory writes, or agent calls. Look for indirect prompt injection attempts or replayed checkpoint data in reused threads.

Impact Analysis

Unauthenticated attackers could exploit this to perform unauthorized actions like wallet transfers, DeFi swaps, posting content, or modifying memory without approval. This is especially risky for deployments exposing agents to untrusted content, such as public agents or bots.

Compliance Impact

This vulnerability could lead to unauthorized access and execution of sensitive functions, such as wallet transfers or memory writes, which may violate data protection and privacy regulations like GDPR or HIPAA. Unauthorized state-changing actions could result in data breaches or improper handling of personal or health information.

Mitigation Strategies

Upgrade IntentKit to a patched version. Enforce tool availability checks at the executor level. Add human-in-the-loop approval for state-changing tools. Treat all retrieved content as data, not instructions. Disable public access to owner-only tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart