VulnSocial

CVE-2026-90579General

LOWCVSS 5.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-13: 2Patch / Workaround · 2026-09-13: 1Technical Details · 2026-09-13: 109-13
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • PeritumAI@peritumAI
    Patch

    your chatbot just believed whoever knocked. Cheshire Cat AI <=1.9.2 default install, no API key -- it trusts a client header that says "I am user X". Reach the server -> impersonate anyone, incl admin. CVE-2026-90579 hit NVD today. Mitigate now: set CCAT_API_KEY, pull it off the open net, wait for the patch.

    Post summary

    The text discloses CVE-2026-90579 in Cheshire Cat AI <=1.9.2, where a default no-API-key setup trusts a client header and allows impersonation. Its main actionable takeaway is mitigation: set CCAT_API_KEY, remove exposure to the open internet, and wait for a patch.

    2000082
    287 followersView on X
  • PeritumAI@peritumAI
    General

    https://nvd.nist.gov/vuln/detail/CVE-2026-90579 https://github.com/cheshire-cat-ai/core/issues/1137

    Post summary

    The provided text contains only a CVE identifier (CVE-2026-90579) and two URLs with no accompanying context, technical details, or explicit indicators of PoCs, exploits, patches, or active exploitation, making it a general mention of the CVE.

    0000053
    287 followersView on X

Explore more

Back to dashboard