CVE-2026-8321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8321
Published
2026-05-11T19:45:08.634Z
Modified
2026-07-08T08:16:30.489181330Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypass
Details

A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8321.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287",
        "CWE-288"
    ]
}
References

Affected packages

Git / github.com/inkeep/agents

Affected ranges

Type
GIT
Repo
https://github.com/inkeep/agents
Events
Introduced
f3c063836599b875a79168a9a343722e5074fe81
Last affected
f3c063836599b875a79168a9a343722e5074fe81
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.58.14"
        },
        {
            "last_affected": "0.58.14"
        }
    ]
}

Affected versions

0.*
0.58.14
v0.*
v0.58.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8321.json"