CVE-2026-90579

Name of the Vulnerable Software and Affected Versions cheshire-cat-ai versions prior to 1.9.3

Description An issue exists where the manipulation of the user id argument in the authorize http key() function within the core/cat/factory/custom auth handler.py file leads to missing authentication. This allows a remote attacker to impersonate any user, including the administrator, by providing a specific client header. This occurs in default installations where no API key is configured.

Recommendations Set the CCAT API KEY environment variable to enable authentication. Remove the server from the open internet to restrict access. As a temporary workaround, restrict access to the authorize http key() function until a patch is available.