CVE-2026-90579
Received Received - Intake

Authentication Bypass in Cheshire Cat AI

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90579
EUVD
EUVD-2026-77064

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cheshire-cat-ai cheshire_cat_ai to 1.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cheshire Cat AI versions up to 1.9.2. It allows remote attackers to bypass authentication by manipulating the user_id parameter in HTTP requests. The system fails to validate the user_id when no API key is configured, granting unauthorized access to user data.

Detection Guidance

Check if the Cheshire Cat AI service is running without an API key configured. Inspect HTTP headers for requests to the service, specifically looking for a user_id header being accepted without authentication. Verify if the files core/cat/auth/connection.py or core/cat/factory/custom_auth_handler.py exist and review their configuration.

Impact Analysis

An attacker could access, read, or modify your private data, including conversation history and memory, without any credentials. This occurs if you use the default configuration without setting an API key.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing user data to unauthorized access. It undermines user isolation and data confidentiality requirements.

Mitigation Strategies

Immediately set a strong API key in the Cheshire Cat AI configuration to enforce authentication. Restrict network access to the service to trusted sources only. Monitor logs for unauthorized access attempts or unusual user_id header usage. Consider upgrading to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart