CVE-2026-76066: IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using IntentKit through 2.6.3 are exposed when they accept unauthenticated or public callers in WEB, API, TWITTER, or TELEGRAM contexts. The issue affects owner-only, state-changing tools that are removed from the per-request tool advertisement but remain present in the full tool registry.
What does an attacker need to exploit this?
An attacker needs the exact name and arguments of a de-advertised tool. They can provide these through indirect prompt injection or by replaying checkpoint and history data on a reused thread; no authentication, user interaction, or approval gate is required.
What actions could an attacker perform?
The vulnerability can permit unauthorized execution of owner-restricted capabilities, including wallet transfer, posting, memory-write, and call-agent functions. Integrity is affected because state-changing tools can be invoked without the intended authorization controls.
How can teams identify whether they may already be affected?
Review executions on reused threads and public-facing WEB, API, TWITTER, and TELEGRAM contexts for calls to owner-only tools that were not advertised for that request. Look specifically for tool invocations whose names and arguments appear in replayed checkpoint or history data, or were induced through indirect prompt content.