Authentication Bypass in inkeep agents (CVE-2026-8321, CVSS 7.3)

Summary

Authentication bypass in inkeep agents (CVE-2026-8321). Risk of unauthorized operations or information disclosure.

Original description

The description as published by the source.

A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

inkeepエージェント0.58.14には、runAuthミドルウェアのcreateDevContext関数に認証を迂回できる脆弱性があります。この脆弱性はリモートから悪用可能で、既に実証済みのコードが公開されています。開発チームはまだこの問題に対応していないようです。

❓ What is the problem

inkeepエージェントの認証バイパス脆弱性

📍 Affected scope

agents-api/src/middleware/runAuth.tsのcreateDevContext関数

🔥 Severity

リモートからの認証迂回を許すため、重大なセキュリティリスクです

🔧 How to fix

開発チームによるソースコードの修正とパッチの提供が必要です

🛡️ Workaround

情報なし

🔍 Detection

脆弱なバージョンが使用されているかを確認する

References

advisory vuldb.com
advisory vuldb.com
advisory nvd.nist.gov
advisory github.com
report github.com
report vuldb.com
web github.com
web github.com
web github.com