{"id":"CVE-2026-76066","summary":"IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode","details":"IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.","modified":"2026-10-15T10:47:40.641920714Z","published":"2026-10-15T01:39:56.474Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76066.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76066.json"},{"type":"PACKAGE","url":"https://github.com/crestalnetwork/intentkit"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76066"},{"type":"ARTICLE","url":"https://www.lasso.security/vulnerability-database/cve-2026-76066"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crestalnetwork/intentkit","events":[{"introduced":"0"},{"last_affected":"8dbdae02e8931428e65934800f70517363566b91"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.6.3"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.6.3","v0.18.0","v0.17.60","v0.17.59","v0.17.58","v0.17.57","v0.17.56","v0.17.55","v0.17.54","v0.17.53","v0.17.52","v0.17.51","v0.17.50","v0.17.49","v0.17.48","v0.17.47","v0.17.46","v0.17.45","v0.17.44","v0.17.43","v0.17.42","v0.17.41","v0.17.40","v0.17.39","v0.17.38","v0.17.37","v0.17.36","v0.17.35","v0.17.34","v0.17.33","v0.17.32","v0.17.31","v0.17.30","v0.17.29","v0.17.28","v0.17.27","v0.17.26","v0.17.25","v0.17.24","v0.17.23","v0.17.22","v0.17.21","v0.17.20","v0.17.19","v0.17.18","v0.17.17","v0.17.16","v0.17.15","v0.17.14","v0.17.13","v0.17.12","v0.17.11","v0.17.10","v0.17.9","v0.17.8","v0.17.7","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.6","v0.16.5","v0.16.4","v0.16.3","v0.16.2","v0.16.1","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.3","v0.12.2","v0.12.1","v0.12.1-dev1","v0.12.0","v0.11.27","v0.11.26","v0.11.25","v0.11.24","v0.11.23","v0.11.22","v0.11.21","v0.11.20","v0.11.19","v0.11.18","v0.11.17","v0.11.16","v0.11.15","v0.11.14","v0.11.13","v0.11.12","v0.11.11","v0.11.10","v0.11.9","v0.11.8","v0.11.7","v0.11.6","v0.11.5","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.5","v0.10.4","v0.10.2","v0.10.1","v0.10.0","v0.9.31","v0.9.30","v0.9.29","v0.9.28","v0.9.27","v0.9.26","v0.9.25","v0.9.24","v0.9.23","v0.9.22","v0.9.21","v0.9.20","v0.9.19","v0.9.18","v0.9.17","v0.9.16","v0.9.15","v0.9.14","v0.9.13","v0.9.12","v0.9.11","v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.74","v0.8.73","v0.8.72","v0.8.71","v0.8.70","v0.8.69","v0.8.68","v0.8.67","v0.8.66","v0.8.65","v0.8.64","v0.8.63","v0.8.62","v0.8.61","v0.8.60","v0.8.59","v0.8.58","v0.8.57","v0.8.56","v0.8.55","v0.8.54","v0.8.53","v0.8.52","v0.8.51","v0.8.50","v0.8.49","v0.8.48","v0.8.47","v0.8.46","v0.8.45","v0.8.44","v0.8.43","v0.8.42","v0.8.41","v0.8.40","v0.8.39","v0.8.38","v0.8.37","v0.8.36","v0.8.35","v0.8.34-dev8","v0.8.34","v0.8.34-dev7","v0.8.34-dev6","v0.8.34-dev5","v0.8.34-dev4","v0.8.34-dev3","v0.8.34-dev2","v0.8.33-dev1","v0.8.33","v0.8.32-dev1","v0.8.32","v0.8.31-dev1","v0.8.31","v0.8.30-dev1","v0.8.30","v0.8.29-dev1","v0.8.29","v0.8.28-dev1","v0.8.28","v0.8.27-dev1","v0.8.27","v0.8.26-dev1","v0.8.26","v0.8.25-dev1","v0.8.25","v0.8.24-dev1","v0.8.24","v0.8.23","v0.8.22-dev6","v0.8.22-dev5","v0.8.22-dev4","v0.8.22","v0.8.22-dev3","v0.8.22-dev2","v0.8.22-dev1","v0.8.21-dev1","v0.8.21","v0.8.20-dev1","v0.8.20","v0.8.19-dev1","v0.8.19","v0.8.18-dev1","v0.8.18","v0.8.17-dev3","v0.8.17","v0.8.17-dev2","v0.8.17-dev1","v0.8.16-dev1","v0.8.16","v0.8.15-dev1","v0.8.15","v0.8.14-dev1","v0.8.14","v0.8.13-dev3","v0.8.13","v0.8.13-dev2","v0.8.13-dev1","v0.8.12-dev6","v0.8.12","v0.8.12-dev5","v0.8.12-dev4","v0.8.12-dev3","v0.8.12-dev2","v0.8.12-dev1","v0.8.11-dev1","v0.8.11","v0.8.10-dev1","v0.8.10","v0.8.9-dev3","v0.8.9","v0.8.9-dev2","v0.8.9-dev1","v0.8.8","v0.8.8-dev1","v0.8.7","v0.8.6-dev3","v0.8.6-dev2","v0.8.6","v0.8.6-dev1","v0.8.5","v0.8.4-dev3","v0.8.4-dev2","v0.8.4","v0.8.4-dev1","v0.8.3-dev1","v0.8.3","v0.8.2","v0.8.1-dev4","v0.8.1-dev3","v0.8.1","v0.8.1-dev2","v0.8.1-dev1","v0.8.0","v0.7.5-dev34","v0.7.5-dev33","v0.7.5-dev32","v0.7.5-dev31","v0.7.5-dev29","v0.7.5-dev30","v0.7.5-dev28","v0.7.5-dev27","v0.7.5-dev26","v0.7.5-dev25","v0.7.5-dev24","v0.7.5-dev23","v0.7.5-dev22","v0.7.5-dev21","v0.7.5-dev20","v0.7.5-dev19","v0.7.5-dev18","v0.7.5-dev17","v0.7.5-dev16","v0.7.5-dev15","v0.7.5-dev14","v0.7.5-dev13","v0.7.5-dev12","v0.7.5-dev11","v0.7.5-dev10","v0.7.5-dev9","v0.7.5-dev8","v0.7.5-dev7","v0.7.5-dev6","v0.7.5-dev5","v0.7.5-dev4","v0.7.5-dev3","v0.7.5-dev2","v0.7.5-dev1","v0.7.4","v0.7.3-dev6","v0.7.3","v0.7.3-dev5","v0.7.3-dev4","v0.7.3-dev3","v0.7.3-dev2","v0.7.3-dev1","v0.7.2-dev2","v0.7.2","v0.7.2-dev1","v0.7.1-dev3","v0.7.1","v0.7.1-dev2","v0.7.1-dev1","v0.7.0-dev.1","v0.7.0","v0.6.32-dev1","v0.6.31-dev1","v0.6.30-dev1","v0.6.29-dev1","v0.6.28-dev1","v0.6.27-dev1","v0.6.26-dev1","v0.6.26","v0.6.25-dev1","v0.6.25","v0.6.24-dev1","v0.6.23-dev1","v0.6.23","v0.6.22-dev1","v0.6.22","v0.6.21-dev3","v0.6.21","v0.6.21-dev2","v0.6.21-dev1","v0.6.20","v0.6.20-dev.1","v0.6.19-dev2","v0.6.19","v0.6.19-dev1","v0.6.18","v0.6.17-dev3","v0.6.17-dev2","v0.6.17","v0.6.17-dev1","v0.6.16","v0.6.15","v0.6.14","v0.6.13-dev2","v0.6.13","v0.6.13-dev1","v0.6.12-dev1","v0.6.12","v0.6.11-dev8","v0.6.11","v0.6.11-dev7","v0.6.11-dev6","v0.6.11-dev5","v0.6.11-dev4","v0.6.11-dev3","v0.6.11-dev2","v0.6.11-dev1","v0.6.10-dev7","v0.6.10","v0.6.10-dev6","v0.6.10-dev5","v0.6.10-dev4","v0.6.10-dev3","v0.6.10-dev2","v0.6.10-dev1","v0.6.9-dev2","v0.6.9","v0.6.9-dev1","v0.6.8-dev3","v0.6.8","v0.6.8-dev2","v0.6.8-dev1","v0.6.7-dev9","v0.6.7-dev8","v0.6.7-dev7","v0.6.7","v0.6.7-dev6","v0.6.7-dev5","v0.6.7-dev4","v0.6.7-dev3","v0.6.7-dev2","v0.6.7-dev1","v0.6.6","v0.6.5-dev8","v0.6.5-dev7","v0.6.5","v0.6.5-dev6","v0.6.5-dev5","v0.6.5-dev4","v0.6.5-dev3","v0.6.5-dev2","v0.6.5-dev1","v0.6.4","v0.6.3-dev3","v0.6.3-dev2","v0.6.3","v0.6.3-dev1","v0.6.2-dev2","v0.6.2","v0.6.2-dev1","v0.6.1-dev1","v0.6.1","v0.6.0-dev.18","v0.6.0","v0.6.0-dev.17","v0.6.0-dev.16","v0.6.0-dev.15","v0.6.0-dev.14","v0.6.0-dev.13","v0.6.0-dev.12","v0.6.0-dev.11","v0.6.0-dev.10","v0.6.0-dev.9","v0.6.0-dev.8","v0.6.0-dev.7","v0.6.0-dev.6","v0.6.0-dev.5","v0.6.0-dev.4","v0.6.0-dev.3","v0.6.0-dev.2","v0.5.7-dev.1","v0.5.7","v0.6.0-dev.1","v0.5.6-dev.3","v0.5.6","v0.5.6-dev.2","v0.5.6-dev.1","v0.5.5-dev.1","v0.5.5","v0.5.4-dev.10","v0.5.4","v0.5.4-dev.9","v0.5.4-dev.8","v0.5.4-dev.7","v0.5.4-dev.6","v0.5.4-dev.5","v0.5.4-dev.4","v0.5.4-dev.3","v0.5.4-dev.2","v0.5.4-dev.1","v0.5.3-dev.1","v0.5.3","v0.5.2-dev.2","v0.5.2","v0.5.2-dev.1","v0.5.1-dev.6","v0.5.1","v0.5.1-dev.5","v0.5.1-dev.4","v0.5.1-dev.3","v0.5.1-dev.2","v0.5.1-dev.1","v0.5.0-dev.18","v0.5.0","v0.5.0-dev.17","v0.5.0-dev.16","v0.5.0-dev.15","v0.5.0-dev.14","v0.5.0-dev.13","v0.5.0-dev.12","v0.5.0-dev.11","v0.5.0-dev.10","v0.5.0-dev.9","v0.5.0-dev.8","v0.5.0-dev.7","v0.5.0-dev.6","v0.5.0-dev.5","v0.5.0-dev.4","v0.4.40-dev.1","v0.4.40","v0.5.0-dev.3","v0.5.0-dev.2","v0.5.0-dev.1","v0.4.39-dev.1","v0.4.39","v0.4.38-dev.1","v0.4.38","v0.4.37-dev.4","v0.4.37","v0.4.37-dev.3","v0.4.37-dev.2","v0.4.37-dev.1","v0.4.34-dev.1","v0.4.22-dev.1","v0.4.22","v0.4.33","v0.4.21","v0.4.20-dev.8","v0.4.20","v0.4.20-dev.5","v0.4.20-dev.7","v0.4.20-dev.6","v0.4.20-dev.4","v0.4.20-dev.3","v0.4.20-dev.2","v0.4.20-dev.1","v0.4.18-dev.6","v0.4.18-dev.5","v0.4.18-dev.4","v0.4.15-dev.3","v0.4.15","v0.4.18-dev.3","v0.4.18-dev.2","v0.4.18-dev.1","v0.4.15-dev.2","v0.4.15-dev.1","v0.4.14","v0.4.13-dev.1","v0.4.13","v0.4.12-dev.3","v0.4.12","v0.4.12-dev.2","v0.4.12-dev.1","v0.4.11-dev.1","v0.4.11","v0.4.10-dev.4","v0.4.10","v0.4.10-dev.3","v0.4.10-dev.2","v0.4.10-dev.1","v0.4.9-dev.2","v0.4.9","v0.4.9-dev.1","v0.4.7-dev.3","v0.4.7-dev.2","v0.4.7-dev.1","v0.4.4-dev.2","v0.4.3-dev.1","v0.4.3","v0.4.4-dev.1","v0.4.2-dev.4","v0.4.2","v0.4.2-dev.3","v0.4.2-dev.2","v0.4.2-dev.1","v0.4.0","v0.3.12-dev.15","v0.3.12-dev.14","v0.3.12-dev.13","v0.3.12-dev.12","v0.3.12-dev.11","v0.3.12-dev.10","v0.3.12-dev.9","v0.3.12-dev.8","v0.3.12-dev.7","v0.3.12-dev.6","v0.3.12-dev.5","v0.3.12-dev.4","v0.3.12-dev.3","v0.3.12-dev.2","v0.3.12-dev.1","v0.3.8-dev.1","v0.3.6-dev.2","v0.3.6-dev.1","v0.3.4-dev.2","v0.3.4-dev.1","v0.3.1-dev.4","v0.3.1-dev.3","v0.3.0-dev.2","v0.3.0","v0.3.1-dev.2","v0.3.1-dev.1","v0.3.0-dev.1","v0.2.31-dev.16","v0.2.31-dev.15","v0.2.31-dev.14","v0.2.31-dev.13","v0.2.31-dev.11","v0.2.31-dev.12","v0.2.31-dev.10","v0.2.31-dev.9","v0.2.31-dev.8","v0.2.31-dev.7","v0.2.31-dev.6","v0.2.31-dev.5","v0.2.31-dev.4","0.2.31-dev.3","v0.2.31-dev.2","v0.2.31-dev.1","v0.2.29-dev.7","v0.2.28-dev.5","v0.2.28","v0.2.29-dev.6","v0.2.29-dev.5","v0.2.29-dev.4","v0.2.29-dev.3","v0.2.29-dev.2","v0.2.29-dev.1","v0.2.28-dev.4","v0.2.28-dev.3","v0.2.28-dev.2","v0.2.28-dev.1","v0.2.27-dev.7","v0.2.27","v0.2.27-dev.6","v0.2.27-dev.5","v0.2.27-dev.4","v0.2.27-dev.3","v0.2.27-dev.2","v0.2.27-dev.1","v0.2.25-dev.3","v0.2.22-dev.1","v0.2.25-dev.2","v0.2.25-dev.1","v0.2.23-dev.4","v0.2.22-dev.8","v0.2.22","v0.2.23-dev.3","v0.2.23-dev.2","v0.2.23-dev.1","v0.2.22-dev.7","v0.2.22-dev.6","v0.2.22-dev.5","v0.2.22-dev.4","v0.2.22-dev.3","v0.2.22-dev.2","v0.2.21-dev.3","v0.2.21","v0.2.21-dev.2","v0.2.21-dev.1","v0.2.19-dev.1","v0.2.17-dev.7","v0.2.17-dev.6","v0.2.17-dev.5","v0.2.17-dev.4","v0.2.17-dev.3","v0.2.17-dev.2","v0.2.17-dev.1","v0.2.14-dev.2","v0.2.13-dev.1","v0.2.13","v0.2.14-dev.1","v0.2.12-dev.2","v0.2.12","v0.2.12-dev.1","v0.2.11-dev.1","v0.2.11","v0.2.10-dev.12","v0.2.10","v0.2.10-dev.11","v0.2.10-dev.10","v0.2.10-dev.9","v0.2.10-dev.8","v0.2.10-dev.7","v0.2.10-dev.6","v0.2.10-dev.5","v0.2.10-dev.4","v0.2.10-dev.3","v0.2.10-dev.2","v0.2.10-dev.1","v0.2.9-dev.2","v0.2.9","v0.2.9-dev.1","v0.2.8-dev.7","v0.2.8","v0.2.8-dev.6","v0.2.8-dev.5","v0.2.8-dev.4","v0.2.8-dev.3","v0.2.8-dev.2","v0.2.6-dev.4","v0.2.8-dev.1","v0.2.7-dev.1","v0.2.7","v0.2.6-dev.5","v0.2.6","v0.2.6-dev.3","v0.2.6-dev.2","v0.2.6-dev.1","v0.2.5-dev.1","v0.2.5","v0.2.4-dev.4","v0.2.4","v0.2.4-dev.3","v0.2.4-dev.2","v0.2.4-dev.1","v0.2.3-dev.4","v0.2.3","v0.2.3-dev.3","v0.2.3-dev.2","v0.2.3-dev.1","v0.2.2-dev.1","v0.2.2","v0.2.1-dev.1","v0.2.1","v0.2.0-dev.19","v0.2.0","v0.2.0-dev.18","v0.2.0-dev.17","v0.2.0-dev.16","v0.2.0-dev.15","v0.2.0-dev.14","v0.2.0-dev.13","v0.2.0-dev.12","v0.2.0-dev.11","v0.2.0-dev.10","v0.2.0-dev.9","v0.2.0-dev.8","v0.2.0-dev.7","v0.2.0-dev.6","v0.2.0-dev.5","v0.2.0-dev.4","v0.2.0-dev.3","v0.2.0-dev.2","v0.2.0-dev.1","v0.1.29-dev.4","v0.1.29","v0.1.29-dev.2","v0.1.29-dev.3","v0.1.29-dev.1","v0.1.27-dev.1","v0.1.25-dev.1","v0.1.25","v0.1.24-dev.2","v0.1.24","v0.1.24-dev.1","v0.1.23-dev.1","v0.1.23","v0.1.22-dev.1","v0.1.22","v0.1.21-dev.2","v0.1.21","v0.1.21-dev.1","v0.1.20-dev.1","v0.1.20","v0.1.19-dev.4","v0.1.19","v0.1.19-dev.3","v0.1.18-dev.2","v0.1.18","v0.1.19-dev.2","v0.1.19-dev.1","v0.1.17-dev.14","v0.1.17","v0.1.18-dev.1","v0.1.17-dev.13","v0.1.17-dev.12","v0.1.17-dev.4","v0.1.17-dev.3","v0.1.17-dev.2","v0.1.17-dev.1","v0.1.16-dev.10","v0.1.16-dev.7","v0.1.16-dev.6","v0.1.16-dev.4","v0.1.16-dev.2","v0.1.16-dev.1","v0.1.15","v0.1.14-dev.6","v0.1.14","v0.1.14-dev.5","v0.1.14-dev.3","v0.1.13-dev.1","v0.1.13","v0.1.12-dev.2","v0.1.12","v0.1.12-dev.1","v0.1.11-dev.1","v0.1.11","v0.1.10-dev.2","v0.1.10","v0.1.10-dev.1","v0.1.9-dev.3","v0.1.9","v0.1.9-dev.2","v0.1.9-dev.1","v0.1.8-dev.1","v0.1.8","v0.1.7","v0.1.6-dev.2","v0.1.6","v0.1.5","v0.1.6-dev.1","v0.1.5-dev.7","v0.1.4-dev.11","v0.1.4","v0.1.4-dev.9","v0.1.4-dev.8","v0.1.4-dev.7","v0.1.4-dev.6","v0.1.4-dev.1","v0.1.3-dev.10","v0.1.3-dev.9","v0.1.3-dev.8","v0.1.3-dev.7","v0.1.3-dev.6","v0.1.3-dev.5","v0.1.3-dev.4","v0.1.3-dev.2","v0.1.3-dev.1","v0.1.2-dev.2","v0.1.2","v0.1.2-dev.1","v0.1.1","v0.1.0-dev.3","v0.1.0","v0.1.0-dev.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76066.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}