CVE-2026-76066

Executive Summary

CVE-2026-76066 is an authorization bypass vulnerability in IntentKit (through version 2.6.3) in which the executor validates tool calls against the full tool registry instead of the per-request narrowed advertisement enforced by ToolBindingMiddleware. This allows unauthenticated or public callers to invoke owner-only, state-changing tools—such as wallet transfer, posting, memory-write, and call-agent—without any human-in-the-loop or approval gate. The vulnerability carries a CVSS of 7.5 (High) and affects any deployment exposing IntentKit through WEB, API, TWITTER, or TELEGRAM contexts.

Technical Analysis

IntentKit is an agent framework in which an LLM-driven executor dispatches tool calls. The intended security model relies on ToolBindingMiddleware, which narrows the set of tools advertised to the model on a per-request basis, thereby restricting which tools the agent can invoke in a given context. The core defect (CWE-862, Missing Authorization) is that the executor validates a requested tool call against the full tool registry rather than the narrowed, per-request tool advertisement produced by ToolBindingMiddleware.

The result is an authorization boundary failure: de-advertised tools remain reachable at execution time. Because validation is performed against the broader registry, the middleware's restriction is advisory rather than enforced. Owner-only, state-changing capabilities—wallet transfer, posting, memory-write, and call-agent—can therefore be executed by a caller who was never intended to have access to them. Critically, the description states these tools execute without any human-in-the-loop or approval gate, eliminating the secondary control that would otherwise block unauthorized state changes.

The attack surface spans every context in which IntentKit dispatches tool calls: WEB, API, TWITTER, and TELEGRAM. This means both direct API/interface callers and callers reaching the agent through social or messaging integrations can trigger the flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms network reachability, low attack complexity, no privileges required, and no user interaction, with High integrity impact and no confidentiality or availability impact—consistent with unauthorized state-changing actions rather than data exfiltration or denial of service.

Two exploitation vectors are explicitly identified in the description: (1) supplying the exact de-advertised tool name and arguments via indirect prompt injection, and (2) replaying checkpoint and history data on a reused thread. Both routes converge on the same root cause—execution-time validation against the full registry rather than the per-request narrowed set.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description. No function names, endpoints, or parameters beyond those appearing verbatim in the description are asserted.

1. Reconnaissance / Target Identification. An attacker identifies a reachable IntentKit deployment exposed through a WEB, API, TWITTER, or TELEGRAM context. Because the vulnerability requires no authentication (PR:N) and no user interaction (UI:N), any network-reachable interface that accepts agent input is a candidate.

2. Triggering the Flaw Class. The attacker causes the executor to dispatch a tool call for a de-advertised, owner-only tool. The description specifies two mechanisms:

   • Indirect prompt injection: The attacker embeds instructions that cause the agent to invoke a restricted tool, supplying the exact de-advertised tool name and arguments. Because the executor validates against the full tool registry, the call is accepted despite not being part of the per-request advertisement enforced by ToolBindingMiddleware.
   • Checkpoint/history replay on a reused thread: The attacker replays checkpoint and history data on a reused thread so that a previously advertised or previously executed tool call is re-dispatched and accepted by the registry-level validation.

3. Payload / Execution. The tool call names an owner-only, state-changing capability—wallet transfer, posting, memory-write, or call-agent—with attacker-supplied arguments. No approval gate or human-in-the-loop check intervenes, so the action executes directly.

4. Post-Exploitation Impact. The attacker achieves unauthorized execution of owner-restricted capabilities: unauthorized wallet transfers, unauthorized posting, unauthorized memory writes (state corruption of agent memory), and unauthorized invocation of downstream agents via call-agent. Because the flaw yields High integrity impact, the primary consequence is unauthorized state modification rather than data disclosure or service disruption.

Impact Assessment

The CVSS base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Subscores indicate: Attack Vector: Network (exploitable remotely), Attack Complexity: Low (no special conditions), Privileges Required: None (unauthenticated/public callers), User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: High, Availability: None.

Business impact centers on integrity: unauthorized wallet transfers represent direct financial loss potential; unauthorized posting exposes brand and reputation risk on connected social channels (TWITTER context); memory-write allows persistent corruption or manipulation of agent state, which can compound across sessions; call-agent permits unauthorized chaining to downstream agents, potentially broadening the blast radius beyond the initial deployment. Because the tools execute without human-in-the-loop approval, there is no compensating control to intercept a malicious action. Any organization running IntentKit through 2.6.3 on a network-reachable WEB, API, TWITTER, or TELEGRAM integration is in scope. EPSs has not yet been scored by FIRST.org, and the CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

title: IntentKit Unauthorized Owner-Only Tool Invocation (CVE-2026-76066)
id: 3f8a1c2e-76066-4b9e-a1d2-000000076066
status: experimental
description: Detects executor-level invocation of owner-only state-changing tools outside the per-request tool advertisement enforced by ToolBindingMiddleware.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76066
author: valtersit.com
date: 2026-01-01
logsource:
  product: intentkit
  service: executor
detection:
  selection_tools:
    tool.name:
      - 'wallet_transfer'
      - 'post'
      - 'memory_write'
      - 'call_agent'
  selection_bypass:
    validation.basis: 'full_registry'
  condition: selection_tools and selection_bypass
falsepositives:
  - Legitimate owner-initiated tool calls within an authorized thread
level: high
tags:
  - attack.t1190
  - cwe.862

YARA Rule

rule CVE_2026_76066_IntentKit_Authz_Bypass
{
    meta:
        description = "Detects IntentKit authorization bypass indicators: full-registry validation and owner-only tool invocation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76066"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-76066"
    strings:
        $a = "ToolBindingMiddleware"
        $b = "full_registry"
        $c = "wallet_transfer"
        $d = "memory_write"
        $e = "call_agent"
        $f = "checkpoint"
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0a3c or true
        and 2 of ($a, $b, $c, $d, $e, $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76066 IntentKit owner-only tool invocation attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"wallet_transfer"; nocase; http.request_body; content:"call_agent"; nocase; classtype:attempted-admin; reference:cve,CVE-2026-76066; sid:7606601; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
  [process where event.action == "executor_validation" and validation.basis == "full_registry"]
  [process where event.action == "tool_invocation" and tool.name in ("wallet_transfer","post","memory_write","call_agent")]

Splunk SPL Query

index=intentkit sourcetype=intentkit:executor
| search (tool_name="wallet_transfer" OR tool_name="post" OR tool_name="memory_write" OR tool_name="call_agent")
| search validation_basis="full_registry" OR NOT tool_advertised=true
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, thread_id, tool_name
| where count > 0

Wazuh OSSEC Rule

<group name="intentkit,cve-2026-76066,">
  <rule id="760660" level="12">
    <decoded_as>json</decoded_as>
    <field name="tool_name">wallet_transfer|post|memory_write|call_agent</field>
    <field name="validation_basis">full_registry</field>
    <description>CVE-2026-76066: IntentKit owner-only tool invoked outside per-request advertisement (possible authorization bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is currently available.

1. Immediate Mitigations

   • Restrict network exposure of IntentKit WEB/API endpoints to trusted networks only; do not expose agent interfaces publicly.
   • Limit or disable public interaction on TWITTER and TELEGRAM integrations where possible, since these contexts are explicitly listed as exploitable.
   • Enforce an independent human-in-the-loop approval gate outside the framework for wallet transfer, posting, memory-write, and call-agent actions, so authorization does not rely solely on the flawed executor.
   • Prevent thread reuse where checkpoint/history replay is feasible, and treat replayed checkpoint data as untrusted input.

2. Patch / Upgrade Steps

   • No patch is available. Monitor the IntentKit project repository and NVD entry for an official fix. Until then, treat all versions through 2.6.3 as vulnerable.
   • When a fix is released, validate that execution-time authorization checks the per-request narrowed tool advertisement rather than the full tool registry before upgrading.

3. Long-Term Hardening

   • Require defense-in-depth: enforce authorization at execution time against the request-scoped tool allowlist, not the global registry.
   • Adopt explicit deny-by-default for owner-only tools, with cryptographic or out-of-band confirmation for state-changing operations.
   • Treat all agent inputs (prompts, checkpoints, history) as untrusted and sanitize/validate tool invocations and arguments.
   • Maintain audit logging of tool invocations with actor identity, thread context, and validation basis to support detection and forensic review.

References

• NVD — CVE-2026-76066: https://nvd.nist.gov/vuln/detail/CVE-2026-76066
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST.org EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• IntentKit project repository (monitor for patch): vendor project source

No public PoC, exploit code, Nuclei template, or in-the-wild campaign evidence is currently associated with CVE-2026-76066.