---
title: IntentKit CVE-2026-76066: hiding an owner-only tool from the model didn't stop public callers from running it | ctxsec
url: https://ctxsec.com/items/intentkit-cve-2026-76066
description: ""
status: "confirmed (CNA advisory); no fixed version listed"
published: 2026-10-15
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/intentkit-cve-2026-76066.md)

confirmed (CNA advisory); no fixed version listed

2026-10-15

### IntentKit CVE-2026-76066: hiding an owner-only tool from the model didn't stop public callers from running it

VulnCheck published CVE-2026-76066 (CVSS 4.0 8.7, CWE-862) on Oct 15 for IntentKit through 2.6.3, an open-source autonomous-agent framework whose agents can hold crypto wallets. The executor checked tool calls against the full tool registry instead of the narrowed per-request tool list, so owner-only, state-changing tools such as wallet transfer, posting, memory-write and call-agent could run with no approval gate. An unauthenticated or public caller in web, API, Twitter or Telegram contexts can trigger them by supplying the de-advertised tool name and arguments through indirect prompt injection, or by replaying checkpoint/history data on a reused thread. Credit: Noy Pearl, Michael Sromin and Ophir Dror (Lasso). VulnCheck lists no patched version. Lesson for any harness: enforce the allowed tool set at execution time, not just in what the model is shown.

Sources: [VulnCheck advisory](https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode) · [Lasso vulnerability entry](https://www.lasso.security/vulnerability-database/cve-2026-76066)