CVE-2026-76066: IntentKit Authorization Bypass Vulnerability

CVE-2026-76066 Overview

CVE-2026-76066 is an authorization bypass vulnerability in IntentKit through version 2.6.3, fixed in commit 5b91da5. The flaw resides in the executor component, which validates tool calls against the full tool registry rather than the per-request tool advertisement enforced by ToolBindingMiddleware. Owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent can execute without any human-in-the-loop or approval gate. Unauthenticated callers in WEB, API, TWITTER, or TELEGRAM contexts can invoke these capabilities by supplying de-advertised tool names via indirect prompt injection or by replaying thread checkpoint and history data.

Critical Impact
Public, unauthenticated attackers can invoke owner-restricted agent tools, including wallet transfers and memory writes, by naming de-advertised tools directly in prompts.

Affected Products

IntentKit through version 2.6.3
IntentKit executor component (ToolNode)
IntentKit ToolBindingMiddleware

Discovery Timeline

2026-10-15 - CVE CVE-2026-76066 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-76066

Vulnerability Analysis

IntentKit builds agent workflows that bind a narrowed set of tools to each request through ToolBindingMiddleware. The middleware advertises only the tools permitted for the current caller context, such as public WEB or API callers versus authenticated owners. The executor, however, resolves tool calls against the complete registry rather than the per-request advertisement. This mismatch produces a missing authorization check [CWE-862] that allows any caller to invoke tools that were never advertised to them.

The vulnerability is reachable from WEB, API, TWITTER, and TELEGRAM contexts. Owner-only state-changing capabilities including wallet transfer, social posting, memory-write, and call-agent execute without approval or human-in-the-loop review.

Root Cause

The root cause is a split between advertisement and enforcement. ToolBindingMiddleware originally maintained parallel guest_tools and team_tools lists, but the executor dispatched tool calls using the full registry. Tools removed from the guest advertisement were still invokable by name. The patch replaces the dual-list design with a single all_tools collection and introduces a team_only marker evaluated at execution time.

Attack Vector

Two exploitation paths exist. First, an attacker can submit indirect prompt injection payloads containing the exact de-advertised tool name and arguments, causing the LLM to emit a tool call the executor accepts. Second, an attacker can replay crafted checkpoint and history data on a reused thread, re-introducing owner-tool invocations into the execution stream.

python

# Patch excerpt: intentkit/core/agent/tool_registry.py
        tools_by_category[category][name] = ToolMeta(
            title=title if isinstance(title, str) and title else name,
            description=description if isinstance(description, str) else "",
+           team_only=bool(tool_field_default(cls, "team_only")),
        )

    catalog: dict[str, _CategoryEntry] = {}

# Patch excerpt: intentkit/core/middleware.py
    llm_model: LLMModel
-   guest_tools: list[BaseTool | dict[str, Any]]
-   team_tools: list[BaseTool | dict[str, Any]]
+   all_tools: list[BaseTool | dict[str, Any]]
    extra_llm_params: dict[str, Any]

Source: GitHub Commit 5b91da5

Detection Methods for CVE-2026-76066

Indicators of Compromise

Agent execution logs showing tool calls to owner-only tool names (wallet transfer, memory-write, call-agent, posting) originating from WEB, API, TWITTER, or TELEGRAM contexts.
Thread history or checkpoint records containing tool invocations that do not match the advertised tool list for the thread's caller context.
Unexpected outbound wallet transactions, social media posts, or memory mutations tied to agents reachable by public callers.

Detection Strategies

Reconcile executor tool-call events against the per-request advertised tool set from ToolBindingMiddleware. Flag any mismatch.
Alert on tool invocations containing names flagged team_only whenever the originating context is unauthenticated.
Inspect inbound user content for strings matching known IntentKit tool identifiers, which indicates prompt-injection probing.

Monitoring Recommendations

Enable verbose logging on the IntentKit executor and ship events to a central store for correlation and retention.
Monitor thread reuse patterns and alert when checkpoint data is loaded from untrusted sources.
Track blockchain and social-platform API activity initiated by agent service accounts for anomalies.

How to Mitigate CVE-2026-76066

Immediate Actions Required

Upgrade IntentKit to the version containing commit 5b91da5 or later.
Audit agent configurations and remove owner-only tools from any agent reachable by public callers until the patch is applied.
Rotate wallet keys, API tokens, and session credentials that could have been exercised by the affected agents.

Patch Information

The fix is published in commit 5b91da5 of the crestalnetwork/intentkit repository. It replaces the guest_tools and team_tools dual-list design with a unified all_tools list and a team_only marker evaluated at execution time, aligning advertisement and enforcement. Additional detail is available in the VulnCheck advisory and the Lasso Security entry.

Workarounds

Restrict agent endpoints to authenticated callers until the patched version is deployed.
Disable or unregister owner-only tools (wallet_transfer, memory_write, call_agent, posting tools) on agents exposed through WEB, API, TWITTER, or TELEGRAM contexts.
Reject reuse of threads whose checkpoint or history data originates outside a trusted boundary.

bash

# Example: pin IntentKit to a patched commit in requirements
pip install "git+https://github.com/crestalnetwork/intentkit.git@5b91da5734d1ac16cd656fa66a86caf8f15cd671"