PT-2026-39756 · Git+1 · Agentis

Eric-D · CVE-2026-8321 · Published 2026-05-11 · Updated 2026-05-11

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions inkeep agents version 0.58.14

Description An authentication bypass via an alternate channel is possible in the runAuth Middleware component. This issue occurs within the createDevContext() function located in the agents-api/src/middleware/runAuth.ts file and can be exploited remotely.

Recommendations As a temporary workaround, consider restricting the use of the createDevContext() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2026-8321

Affected Products

Agentis

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8321.json · Exploit
• 🔥 https://github.com/inkeep/agents/issues/3024 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8321 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8321 · Vendor Advisory
• https://vuldb.com/vuln/362608 · Note
• https://vuldb.com/vuln/362608/cti · Note
• https://vuldb.com/submit/811314 · Note
• https://github.com/inkeep/agents · Note