CVE-2026-90579: Cheshire Cat AI Auth Bypass Vulnerability

CVE-2026-90579 Overview

CVE-2026-90579 is a missing authentication vulnerability [CWE-287] in the Cheshire Cat AI framework versions up to and including 1.9.2. The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py. Manipulation of the user_id argument allows attackers to bypass authentication controls remotely without valid credentials. The exploit details have been publicly disclosed. According to the vulnerability report, the project maintainers were notified through a GitHub issue but have not yet responded. Cheshire Cat AI is an open-source framework for building conversational AI agents powered by large language models.

Critical Impact
Remote attackers can bypass authentication in the HTTP key authorization flow by manipulating the user_id argument, gaining unauthorized access to the AI agent framework without valid credentials.

Affected Products

cheshire-cat-ai Cheshire Cat AI versions up to and including 1.9.2
core/cat/factory/custom_auth_handler.py component
Deployments exposing the Cheshire Cat AI HTTP interface to untrusted networks

Discovery Timeline

2026-09-13 - CVE-2026-90579 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90579

Vulnerability Analysis

The vulnerability originates in the _authorize_http_key function of custom_auth_handler.py. This function is responsible for validating HTTP-based key authentication requests against submitted user_id values. Improper handling of the user_id argument means the function does not enforce authentication before authorizing a request. An attacker can supply a crafted user_id value and receive authorization without presenting valid credentials.

The issue is classified under [CWE-287] Improper Authentication. The EPSS probability sits at 0.391% with a percentile of 33.099, indicating limited observed exploitation activity, though a public exploit disclosure raises the practical risk. The attack requires no user interaction and can be triggered over a network.

Root Cause

The root cause is missing authentication logic in the custom HTTP key authorization path. The _authorize_http_key function trusts the user_id argument without validating that the requester possesses a legitimate credential bound to that identity. This design gap allows the authorization decision to succeed based on attacker-supplied input alone.

Attack Vector

An attacker connects to an exposed Cheshire Cat AI instance over the network and submits an HTTP request that invokes the custom authentication handler with a chosen user_id. Because the handler skips proper credential verification, the request proceeds as if authenticated. No prior privileges or user interaction are required.

Refer to the GitHub Issue Discussion and the VulDB Vulnerability Details for the disclosed technical description. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-90579

Indicators of Compromise

HTTP requests to Cheshire Cat AI endpoints containing unexpected or sequentially enumerated user_id parameter values
Successful authorization events for user_id values that do not correspond to provisioned accounts
Access to administrative or agent-configuration endpoints from IP addresses not associated with legitimate operators
Anomalous spikes in requests targeting routes handled by custom_auth_handler.py

Detection Strategies

Instrument the _authorize_http_key code path with structured logging that records request origin, submitted user_id, and the authorization outcome
Correlate application logs with reverse proxy or web application firewall logs to identify unauthenticated access to protected routes
Baseline normal user_id usage patterns and alert on new or unexpected identifiers appearing in authorization flows

Monitoring Recommendations

Forward Cheshire Cat AI application logs to a centralized logging platform for retention and correlation
Monitor for outbound traffic from the AI host that suggests data exfiltration or prompt-injection follow-on activity
Track configuration changes made through authenticated sessions to detect abuse of the bypass

How to Mitigate CVE-2026-90579

Immediate Actions Required

Restrict network exposure of Cheshire Cat AI instances to trusted networks only, using firewalls or reverse proxy allowlists
Place the application behind an authenticating reverse proxy that enforces its own credential validation before requests reach custom_auth_handler.py
Audit existing deployments for unauthorized access by reviewing authorization logs for anomalous user_id values
Rotate any secrets, API keys, or model provider credentials stored within exposed Cheshire Cat AI instances

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, the project maintainers were informed through a GitHub Issue but have not yet responded. Monitor the cheshire-cat-ai/core repository for updated releases beyond version 1.9.2 that address the missing authentication in _authorize_http_key.

Workarounds

Disable the custom HTTP key authentication handler if it is not required and rely on an alternative authentication mechanism
Enforce mutual TLS or an upstream authentication proxy (such as OAuth2 Proxy or an API gateway) in front of the Cheshire Cat AI service
Apply IP-based access control lists to limit which hosts can reach the vulnerable endpoints
Run the service inside an isolated network segment with no direct internet exposure until a fixed release is available

bash

# Example: restrict Cheshire Cat AI to localhost and front it with an authenticating reverse proxy
# 1. Bind the service to loopback only
export CORE_HOST=127.0.0.1
export CORE_PORT=1865

# 2. Example nginx snippet enforcing basic authentication upstream of the app
# server {
#     listen 443 ssl;
#     location / {
#         auth_basic "Restricted";
#         auth_basic_user_file /etc/nginx/.htpasswd;
#         proxy_pass http://127.0.0.1:1865;
#     }
# }