CVE-2026-90579: cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Cheshire Cat AI versions up to and including 1.9.2 are identified as affected. The available information does not state whether a fixed version is available.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires neither prior privileges nor user interaction. It involves manipulating the user_id argument handled by _authorize_http_key in core/cat/factory/custom_auth_handler.py.
How urgent is mitigation?
Public exploit disclosure has occurred, so exploitation may be possible by attackers using available exploit information. The project was reportedly notified through an issue report but had not responded at the time of the report.