# IntentKit: owner-only tools ran for unauthenticated callers

> IntentKit hid owner-only tools from the model but still let the executor run them, so a public caller could trigger a wallet transfer.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-15
- **CVE:** CVE-2026-76066
- **CVSS:** 8.7
- **Affects:** IntentKit
- **Research by:** Noy Pearl, Michael Sromin, Ophir Dror
- **Primary source:** https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode
- **Page:** https://theinjection.dev/items/intentkit-toolnode-authorization-bypass/

CVE-2026-76066 lets an unauthenticated caller run IntentKit's owner-only tools, including a wallet transfer, because the executor checks the full tool registry instead of the tools advertised for that turn.

## What happened

VulnCheck published CVE-2026-76066 on October 15, 2026, an authorization bypass in IntentKit, an open-source framework for autonomous AI agents from Crestal Network. The advisory credits Noy Pearl, Michael Sromin and Ophir Dror. Lasso Security's vulnerability database carries its own entry for the flaw and names the four source files involved.

## How it works

The bypass is a missing authorization check, CWE-862, between two layers that disagree about which tools exist. ToolBindingMiddleware narrows the tool list advertised to the model for each request, but the executor builds its ToolNode from the full private tool registry, so a call naming a de-advertised tool still runs. An attacker reaches it either by indirect prompt injection in content the agent retrieves, naming the tool and its arguments, or by replaying checkpoint and history data on a reused thread. Lasso Security reports that no tool carries an approval or human-in-the-loop gate.

## Who is affected

VulnCheck lists IntentKit 2.6.3 and every earlier release as affected. Exposure depends on reach: a caller in the WEB, API, TWITTER or TELEGRAM contexts needs no authentication, so agents published to public users or fed untrusted content are the exposed configurations. Lasso Security names the always-present cdp_native_transfer wallet tool, plus DeFi swap, posting and memory-write tools, as the state-changing ones within reach.

## What to do

Build the executor's ToolNode from the same context-filtered tool set shown to the model, or reject any call whose tool name is not in that turn's advertised set, as Lasso Security recommends. Add an approval or human-in-the-loop gate on state-changing tools, enabled by default for public or shared agents. Treat retrieved and inbound-message content as data, not instructions.

## Quick facts

- **Affected:** IntentKit 2.6.3 and earlier
- **Fixed in:** Not named in either advisory; the latest release is v2.6.3 from June 14, 2026
- **CVE:** CVE-2026-76066
- **CVSS 4.0:** 8.7, from VulnCheck
- **Weakness:** CWE-862, missing authorization at the executor
- **Found by:** Noy Pearl, Michael Sromin and Ophir Dror
- **Disclosed:** October 15, 2026

## Questions

### Is there a patch for CVE-2026-76066 in IntentKit?

No fixed IntentKit version is named in either the VulnCheck or the Lasso Security advisory for CVE-2026-76066. VulnCheck lists 2.6.3 and earlier as affected, and the project's most recent GitHub release is v2.6.3 from June 14, 2026. Until a patched release appears, Lasso Security's mitigations are the available defense: filter tools at the executor and gate state-changing tools.

### Which IntentKit deployments are exposed to this tool bypass?

Deployments that expose an IntentKit agent to public users or to untrusted content are exposed, because a caller in the WEB, API, TWITTER or TELEGRAM contexts needs no authentication. Lasso Security calls this a high priority for those setups. A private agent that serves only its owner and never ingests retrieved content has far less reach, though the missing check is still present.

### How is CVE-2026-76066 different from ordinary prompt injection?

Prompt injection supplies the text, while CVE-2026-76066 is the reason that text lands. IntentKit already narrows the tools advertised to the model on each request, a control that should put hidden tools out of reach. Because the executor still validates against the full registry, that narrowing is cosmetic. A second path, replaying checkpoint and history on a reused thread, needs no injected prompt.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode)
2. [Lasso Vulnerability DB](https://www.lasso.security/vulnerability-database/cve-2026-76066)
3. [IntentKit Repo](https://github.com/crestalnetwork/intentkit)