IntentKit: owner-only agent tools, including wallet transfer, run for public callers with no approval step because the executor checks the full tool registry; fix committed 5 July 2026 but in no release on the Python Package Index, CVE published 15 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The agent's owner, to whom state-changing tools such as wallet transfer, posting, memory-write and call-agent are restricted | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry | high |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry | low |
| Actor | An agent built on IntentKit through 2.6.3, an open-source framework for building autonomous AI agents. Lasso Security says a wallet transfer tool (cdp_native_transfer) is present in every agent's private tool set by default; in the maintainer's code at version 2.6.3 that tool belongs to an optional 'Wallet Operations' toolset that is switched off by default, with the transfer tool set to 'disabled' unless the operator changes it | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database); intentkit/tools/cdp/schema.json at tag v2.6.3 ('Wallet Operations' toolset, IntentKit repository) | medium |
| Inputs | A tool call naming a de-advertised owner-only tool and its arguments, supplied by an unauthenticated or public caller in WEB, API, TWITTER or TELEGRAM contexts through indirect prompt injection, or by replaying checkpoint and history data on a reused thread | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry | high |
| Decision | The executor validates the tool call against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, and accepts it | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database) | high |
| Envelope: constraints | Tool permissions are enforced only in the list of tools shown to the model; the executor is built from the full private tool set, and no approval step applies to these tools | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database) | high |
| Action | Owner-restricted, state-changing tools, including wallet transfer, posting, memory-write and call-agent, can execute for a non-owner caller without any human-in-the-loop or approval gate | fact | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry | high |
| Outcome | State: pending (no release on the Python Package Index contains the fix). No exploitation reported in the sources; Lasso Security lists no known exploit and describes reproducing the flaw in a local test harness with a harmless stand-in for an owner transfer. As of 21 Oct 2026. | assertion | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database); CVE record CVE-2026-76066 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-862, affected range, credits | medium |
| Evidence: event | CVE-2026-76066, assigned by VulnCheck as CVE Numbering Authority (reserved 18 August 2026; public date given as 12 October 2026; record published 15 October 2026), weakness CWE-862 Missing Authorization (CWE: Common Weakness Enumeration), VulnCheck severity scores of 8.7 on the Common Vulnerability Scoring System (CVSS, a severity score) version 4.0 and 7.5 on CVSS version 3.1; affected versions through 2.6.3; finders credited as Noy Pearl, Michael Sromin and Ophir Dror. On 15 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added an assessment rating exploitation as proof of concept ('poc') and automatable | fact | IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck); NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database); CVE record CVE-2026-76066 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-862, affected range, credits | high |
| Recovery: technical | No fixed version is named in the CVE record or the National Vulnerability Database. Lasso Security names IntentKit commit 5b91da57 as the fix and advises building from main at or after it until a release containing it is published. The commit, dated 5 July 2026, removes owner-only ('team_only') tools from the tools offered to guests and makes the tools it keeps reserved for the owning team re-check permission when they run; the maintainer's changelog lists the change under 'Release v2.9.0'. As of 21 October 2026 the newest IntentKit release on the Python Package Index is 2.6.3, published 14 June 2026, so no release on the Python Package Index contains the fix | fact | IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck); NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database); feat: team_only tool marker replaces the guest/team dual tool lists (IntentKit commit 5b91da57); Release v2.9.0 (IntentKit CHANGELOG.md on main); intentkit release history (Python Package Index) | high |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry; CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database); CVE record CVE-2026-76066 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-862, affected range, credits | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: the per-request narrowing of tools existed only in what was advertised to the model, while the executor accepted any tool in the full registry. Why it interrupts: if the narrowed tool set were enforced at execution, a call naming a de-advertised tool would be rejected however it reached the executor. Source shows it failed: the record says the executor validates against the full registry rather than the narrowed advertisement. | C-M2 Machine-enforceable scope |
| failed | Mechanism: tools restricted to the owner ran for a public, non-owner caller. Why it interrupts: binding each owner-only tool to the owner principal at execution would refuse the call from any other caller. Source shows it failed: the records say non-owner and unauthenticated callers can run owner-only tools. | C-A2 Authority binding |
| failed | Mechanism: the record names indirect prompt injection as one route by which an attacker supplies the de-advertised tool name and arguments. Why it interrupts: if read content were never treated as instruction, that route could not produce the tool call (the history-replay route is unaffected). Source shows it failed only by naming the route; the counterfactual is not shown. | C-I1 Retrieved content as data |
| absent | Mechanism: state-changing tools including wallet transfer executed with no confirmation step. Why it interrupts: a confirmation or threshold on transfers and posts would put a human decision between the injected call and the effect. Source shows it absent: the record says the tools execute without any human-in-the-loop or approval gate. | C-E3 Destructive-action gate |
Inference
inference In the affected versions, through 2.6.3, tools reserved for the owner were withheld from the list shown to the model but not from the executor, which accepted any tool in the agent's full list and did not check who was asking. A non-owner who got a withheld tool's name and arguments into the conversation, by indirect prompt injection or by replaying thread history, could therefore run it with no approval step, including the wallet tool where it is enabled. The maintainer's later change makes the tools it keeps reserved for the owning team, such as posting and wallet transfer, re-check permission when they run, but no release on the Python Package Index contains it. The record does not show exploitation, any loss, or how many deployed agents had wallet tools enabled.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-76066 | NVD record CVE-2026-76066: IntentKit through 2.6.3 authorization bypass, executor validates tool calls against the full tool registry | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| LASSO | CVE-2026-76066: Executor Tool Authorization Bypass via ToolNode (Lasso Security vulnerability database) | researcher primary record | lasso.security ↗ checked 2026-10-21 |
| CVE-76066 | CVE record CVE-2026-76066 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-862, affected range, credits | public record secondary | cve.threatint.com ↗ checked 2026-10-21 |
| CVE-ORG | IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (CVE-2026-76066 record, assigner VulnCheck) | public record primary record | cve.org ↗ checked 2026-10-21 |
| FIX-5B91 | feat: team_only tool marker replaces the guest/team dual tool lists (IntentKit commit 5b91da57) (interest: maintainer describing its own change) | company primary record | github.com ↗ checked 2026-10-21 |
| CHANGELOG-IK | Release v2.9.0 (IntentKit CHANGELOG.md on main) (interest: maintainer describing its own release) | company primary record | github.com ↗ checked 2026-10-21 |
| PYPI-IK | intentkit release history (Python Package Index) | public record primary record | pypi.org ↗ checked 2026-10-21 |
| SCHEMA-263 | intentkit/tools/cdp/schema.json at tag v2.6.3 ('Wallet Operations' toolset, IntentKit repository) (interest: maintainer's own code) | company primary record | github.com ↗ checked 2026-10-21 |