CVE-2026-92546

Keepnet Agentic Ally authentication bypass through token spoofing

Keepnet Labs Cybersecurity Inc. · Agentic AI / Agentic Ally

First documented disclosure · Review checkpoint

Summary

Token spoofing can bypass authentication in affected Agentic Ally builds.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The CNA title identifies the X-Agentic-Ally-Token header; the public advisory describes authentication bypass by spoofing without publishing detailed validation logic.

Conditions required

Network access to an affected service; the CNA vector requires no prior privileges or user interaction.

Potential impact

Potential unauthorized access to confidential information. The CNA does not rate integrity or availability impact or establish account takeover.

Affected versions and configurations

Builds before 0ef61f2e, using the vendor’s custom build identifier.

Fix and mitigation status

0ef61f2e or later, per the Turkish government bulletin.

Practical next steps

Obtain and deploy build 0ef61f2e or a later confirmed fixed build; verify the installed build with the service owner.

Operating lesson

Agent service authentication must validate token authenticity rather than trust a client-supplied header.

Evidence and limits

The Turkish government bulletin and CNA record are dated October 27. No semantic version, victim count, exploit campaign or broader account-compromise claim is established.

Sources