Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90579

cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90579

Published

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90579

Published

Cheshire Cat AI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "cheshire-cat-ai",
                    "product": "Cheshire Cat AI",
                    "versions": [
                        {
                            "version": "1.9.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.9.1",
                            "status": "affected"
                        },
                        {
                            "version": "1.9.2",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:cheshire-cat-ai:cheshire_cat_ai:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON