CVE-2026-8321
inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypass
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 11, 2026
- Updated
- May 12, 2026
- Reserved
- May 11, 2026
Description
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
agentsinkeep |
|
References
- VDB-362608 | inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypassvdb-entrytechnical-description
- VDB-362608 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #811314 | inkeep agents 0.58.14 Authentication Bypass (CWE-288)third-party-advisory
- https://github.com/inkeep/agents/issues/3024exploitissue-tracking
- https://github.com/inkeep/agents/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.