CVE-2026-76066 in IntentKit
Summary
by MITRE • 10/15/2026
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
IntentKit versions through 2.6.3 exhibit a critical authorization bypass vulnerability rooted in a fundamental architectural flaw within its tool invocation logic. The core issue arises from a discrepancy between the middleware layer and the executor component responsible for processing requests. Specifically, while ToolBindingMiddleware correctly enforces access controls by narrowing down the available tools based on per-request context and user permissions, this restriction is not propagated to the underlying executor. Instead, the validator within the executor checks tool calls against the full global tool registry rather than the restricted set advertised in the current request context. This design oversight effectively nullifies the security boundaries established at the middleware level, creating a path for unauthorized access to privileged functionalities that are intended to be inaccessible under normal operational conditions.
The technical exploitation of this flaw allows an attacker to execute owner-only state-changing operations without requiring human-in-the-loop approval or explicit authorization gates. Tools such as wallet transfers, posting capabilities, memory writes, and agent-to-agent calls are typically restricted due to their high-impact nature on system integrity and user data. However, because the executor ignores the narrowed tool advertisement, an unauthenticated or public caller can bypass these restrictions entirely. The attacker achieves this by supplying the exact names of de-advertised tools along with specific arguments directly into the request payload. This mechanism effectively circumvents the intended permission model, allowing actions that should be strictly limited to administrators or verified owners to be executed by any entity capable of interacting with the system's input interfaces.
The operational impact of this vulnerability is severe, particularly given its potential for exploitation through indirect prompt injection and state replay attacks. Attackers operating in WEB, API, TWITTER, or TELEGRAM contexts can leverage these vectors to inject malicious tool calls into legitimate conversations. By carefully crafting inputs that mimic valid commands but target the restricted tools, an attacker can trigger unauthorized transactions or data modifications. Furthermore, the vulnerability is exacerbated by the reuse of threads and checkpoints; if historical data containing such injected instructions is replayed on a reused thread, the system may execute these malicious tool calls automatically without further user interaction. This capability enables persistent compromise scenarios where an attacker gains ongoing control over sensitive assets or can manipulate agent behavior in ways that were not anticipated by the developers.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the system fails to enforce proper access controls on critical resources. In terms of offensive security frameworks, it maps closely to MITRE ATT&CK techniques involving privilege escalation and unauthorized resource access, specifically within the context of AI agent orchestration where tool execution represents a significant attack surface. The ability to execute arbitrary code or commands through prompt injection further relates to CWE-94 Improper Control of Generation of Code (Code Injection).
To mitigate this vulnerability, immediate remediation is required by ensuring that the executor strictly adheres to the narrowed set of tools defined in the request context rather than relying on a global registry. Developers must implement strict validation checks at the execution layer to verify that every tool call corresponds exactly to an entry in the per-request allowed list generated by ToolBindingMiddleware. Additionally, input sanitization and prompt injection defenses should be strengthened across all supported interfaces including WEB, API, TWITTER, and TELEGRAM. It is also advisable to audit thread reuse mechanisms to prevent the replay of potentially malicious historical data that could trigger unauthorized tool executions. Until a patched version is deployed, administrators should consider restricting public access to affected endpoints or implementing additional external validation layers to compensate for the internal logic flaw.