Missing Authentication in Cheshire Cat AI by Cheshire Cat AI
CVE-2026-90579

6.9MEDIUM

Key Information:

Vendor: Cheshire-cat-ai
Status: Cheshire Cat Ai
Vendor: CVE Published:; 13 September 2026

🔔 Create Cheshire-cat-ai Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90579?

A vulnerability exists in Cheshire Cat AI versions up to 1.9.2 due to improper handling of the user_id argument in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py. This means that an attacker could potentially exploit this issue to bypass authentication mechanisms remotely. Despite early disclosure of the issue to the project team through an issue report, there has been no response, leaving the vulnerability open for exploitation. Users are advised to review their implementations and apply necessary precautions.

Affected Version(s)

Cheshire Cat AI 1.9.0

Cheshire Cat AI 1.9.1

Cheshire Cat AI 1.9.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90579 - Proof of Concept