-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0241
============================================================

Advisory-ID:  0xCERT-2026-0241
Severity:     High
Published:    2026-10-15T02:20:15.000Z
Updated:      2026-10-15T04:35:55.778Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0241

Title: IntentKit through 2.6.3 lets public callers run owner-only tools, including wallet transfers

Summary
- -------
IntentKit (crestalnetwork/intentkit) through 2.6.3 enforces tool visibility only when advertising tools to the model, not at execution, so a public caller can get owner-only tools such as the wallet transfer tool executed with no approval step. No fixed release was identified; operators of public agents should restrict state-changing tools.

Details
- -------
Summary
IntentKit, an open-source framework for autonomous AI agents with built-in crypto wallet and DeFi tools, contains an authorization bypass (CVE-2026-76066, CVSS 3.1 7.5 High). The executor validates tool calls against the full tool registry rather than the per-request narrowed tool list enforced by ToolBindingMiddleware. As a result, owner-only state-changing tools remain callable in public contexts.

Affected
- - crestalnetwork/intentkit (PyPI: intentkit) through 2.6.3
- - No fix available at time of publication (2.6.3 is the latest PyPI release as of this advisory)

Impact
An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can supply the exact de-advertised tool name and arguments, via indirect prompt injection in content the agent fetches or by replaying checkpoint and history data on a reused thread. This lets them run owner-restricted tools such as wallet transfer (cdp_native_transfer), DeFi swaps, posting, memory-write, and call-agent without any human-in-the-loop or approval gate. Lasso Security lists no known exploitation.

Recommended actions
- - Do not expose IntentKit agents with funded wallets to public users or untrusted content until a fix is released.
- - Enforce tool availability at the executor: build the ToolNode from the same context-filtered tool set the model is shown, or reject tool calls not in the current turn's advertisement.
- - Add an approval gate for state-changing tools (wallet transfers, DeFi, posting), on by default for public or shared agents.
- - Treat retrieved and inbound-message content as data, and ignore tool directives that come from it.

Source & attribution
This 0xCERT advisory summarises a disclosure by VulnCheck (CNA) and Lasso Security: https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode and https://www.lasso.security/vulnerability-database/cve-2026-76066. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode
- - CVE-2026-76066
- - https://www.lasso.security/vulnerability-database/cve-2026-76066
- - https://nvd.nist.gov/vuln/detail/CVE-2026-76066

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrQsakJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdRGuStLkYTpZIwdyXQMPisyOUpNCucjGzz3rCZ
IBSppBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABYUAEA24MYKLxR9e3fvnks
0ouhDGNahQ1oeLLmkMOB+6uk6lUBAJmsXGGKGtyVK6y6MVrTnSeFwRzMBzQs
RzkmW5ZGFL4G
=w/MO
-----END PGP SIGNATURE-----