CVE-2026-76066 Details

An authorization bypass vulnerability has been identified in IntentKit versions through 2.6.3. The issue arises because the executor validates tool calls against the complete tool registry instead of the narrowed tool advertisement required by ToolBindingMiddleware. This flaw allows unauthorized execution of owner-only tools that change state, such as wallet transfers, posting, memory writing, and call-agent functions. The vulnerability can be exploited by an unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts, by providing the exact name and arguments of the de-advertised tool through indirect prompt injection or by replaying checkpoint and history data on a reused thread.

It is recommended to enforce tool availability at the executor level, ensuring that only tools advertised for the current context can be executed. Additionally, implementing a human-in-the-loop or approval gate for state-changing tools, especially in public or shared agent deployments, would help mitigate this vulnerability.