CVE-2026-76066

The IntentKit software (through version 2.6.3 ) is vulnerable to an authorization bypass because the executor validates tool calls against the full tool registry instead of the narrowed tool advertisement enforced by ToolBindingMiddleware . This flaw allows unauthenticated or public callers in WE...