IntentKit: Authorization bypass in tool executor allows owner-only tool execution
Summary
IntentKit through 2.6.3 lets callers run owner-only tools such as wallet transfer, posting, memory write and call-agent, even though these tools are hidden from the model for public users. The executor checks tool calls against the full tool registry instead of the per-request narrowed list, and no human approval gate exists. Unauthenticated or public callers in WEB, API, TWITTER or TELEGRAM contexts can trigger this through indirect prompt injection or by replaying history on a reused thread.
Affected
- crestalnetwork intentkit versions 0 through 2.6.3
Fixed in
- Fix included in commit 5b91da5734d1ac16cd656fa66a86caf8f15cd671
- Fixed release version: Unknown.
Workaround
- Unknown. No vendor workaround found.
- Restrict or disable public channels (WEB, API, Twitter, Telegram) for agents that hold wallet, posting, memory or agent-call tools.
- Require human approval for wallet transfers at the wallet or chain layer.
- Limit thread reuse.
Exploitation
- CISA SSVC: exploitation status poc, automatable: yes, technical impact: partial.
- Not listed as known exploited. No public exploit code found in research.
Our recommendation
- Identify all IntentKit instances and their version or commit. Check for commit 5b91da5 or a later release.
- Check whether these instances are reachable from the internet or from public social channels.
- Apply the fix or restrict public access and agent tools until patched.
- Monitor for unexpected wallet transfers, posts and memory writes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 5b91da5 (GitHub) github.com
- VulnCheck advisory www.vulncheck.com
- Lasso vulnerability database entry www.lasso.security
- OpenCVE entry app.opencve.io
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:38.
Original description (NVD)
IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.