{"id":"CVE-2026-92546","kind":"vulnerability","aliases":["CVE-2026-92546"],"related":[],"title":"Keepnet Agentic Ally: authentication bypass by spoofing before commit 0ef61f2e","description":"Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass.\n\nThis issue affects Agentic AI / Agentic Ally: before 0ef61f2e.","summary":"Keepnet Labs' Agentic AI / Agentic Ally product before commit 0ef61f2e has an authentication bypass caused by spoofing. An attacker can likely get past login checks and act as another user, though the sources do not say exactly which identity is spoofed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentic-ai","ai-tooling","keepnet"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Update Keepnet Agentic AI / Agentic Ally to a build at or after commit `0ef61f2e`, per the vendor.","status":"open","published_at":"2026-10-27T13:17:02+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:15+00:00","updated_at":"2026-10-27T13:32:15+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-27T13:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update Keepnet Agentic AI / Agentic Ally to a build at or after commit `0ef61f2e`, per the vendor.","reach":"unknown","title":"Keepnet Agentic Ally: authentication bypass by spoofing before commit 0ef61f2e","impact":"high","summary":"Keepnet Labs' Agentic AI / Agentic Ally product before commit 0ef61f2e has an authentication bypass caused by spoofing. An attacker can likely get past login checks and act as another user, though the sources do not say exactly which identity is spoofed.","category":"ai-tooling","nicknames":[],"who_cares":["keepnet","agentic-ai"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker bypasses authentication and acts as another user.","analyst_note":"Check the NVD entry and the vendor advisory for affected versions, the exact spoofing vector, and whether a fixed release exists beyond commit 0ef61f2e.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run Keepnet Agentic AI / Agentic Ally builds earlier than commit `0ef61f2e`. The sources do not say which deployment modes or configurations are exposed, so unknown whether hosted or self-hosted installs differ.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000585,"input_tokens":3308,"output_tokens":508,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92546':13A,16A '0ef61f2e':10A,33B,90C 'act':50B 'affect':84C 'agent':2A,18B,26B,28B,75C,77C,85C,87C 'agentic-ai':17B 'ai':19B,21B,27B,76C,86C 'ai-tool':20B 'alli':3A,29B,78C,88C 'allow':79C 'anoth':52B 'attack':42B 'authent':4A,36B,65C,80C 'bypass':5A,37B,66C,81C 'caus':38B 'check':48B 'commit':9A,32B 'cve':11A,14A 'cybersecur':73C 'exact':60B 'get':45B 'ident':62B 'inc':74C 'issu':83C 'keepnet':1A,23B,24B,71C 'lab':25B,72C 'like':44B 'login':47B 'past':46B 'product':30B 'say':59B 'sourc':56B 'spoof':7A,40B,64B,68C 'though':54B 'tool':22B 'user':53B 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Keepnet Agentic AI / Agentic Ally builds earlier than commit `0ef61f2e`. The sources do not say which deployment modes or configurations are exposed, so unknown whether hosted or self-hosted installs differ.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92546","severity":null,"published_at":"2026-10-27T13:17:02+00:00","modified_at":"2026-10-27T13:17:02+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}