Read the docs
TI-2026-74570 Aliases CVE-2026-76066GHSA-6qqv-mhm9-qrfj

Authorization bypass in IntentKit lets callers run owner-only tools

Priority HIGH 77CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

IntentKit through 2.6.3 has a missing authorization flaw (CWE-862) in its executor, which checks tool calls against the full tool registry instead of the narrowed tool set advertised for each request. An unauthenticated or public caller in the WEB, API, TWITTER, or TELEGRAM contexts can run owner-only tools such as wallet transfer, posting, memory write, and call-agent without any human approval step. An attacker can use indirect prompt injection or replayed checkpoint and history data on a reused thread to trigger these tools.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
crestalnetworkintentkitup to 2.6.3—Patch availableCNA
  • intentkit Vendorcrestalnetwork Affected up to 2.6.3 Fixed in — Patch available CNA

Remediation

Apply commit 5b91da5, which fixes IntentKit through 2.6.3. The sources list no fixed release version for IntentKit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-76066
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → HIGH
  4. 2026-10-22 Fix available: crestalnetwork/intentkit@5b91da5734d1ac16cd656fa66a86caf8f15cd671 · CNA
  5. 2026-10-22 1 new reference · CNA
  6. 2026-10-22 Alias added: GHSA-6qqv-mhm9-qrfj

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences