What happened
Cheshire Cat AI's custom HTTP-key authorization handler has a missing-authentication flaw: manipulating the user_id parameter allows an attacker to bypass the intended access control, with public exploit disclosure noted by multiple trackers as of Sept 13, 2026.
Why it matters
Cheshire Cat AI is an open-source framework for building conversational AI agents; an authentication bypass in its core HTTP auth handler exposes any self-hosted deployment to unauthorized access of the agent's chat interface, memory, and any connected tools/plugins — a direct path to data exposure or agent hijacking on affected instances.
Attack vector
The _authorize_http_key function in core/cat/factory/custom_auth_handler.py fails to properly validate the user_id argument, allowing a remote attacker to manipulate this value to bypass authentication entirely. The exploit has reportedly been publicly disclosed, and can be triggered remotely without prior authentication.
Affected systems
cheshire-cat-ai (Cheshire Cat AI) ≤ 1.9.2
Mitigation
Consult the cheshire-cat-ai project issue tracker and upstream repository for a patched release; operators should restrict network exposure of the HTTP API and monitor for unauthorized access pending an official fix.