Security advisory
Agentic AI API authentication issue CVE-2026-92546
- Resolved
- No customer action required
- Published
28 August 2026, from report to fix in production
- Customer data
- Not affected
- Main Keepnet platform
- Not affected
- Customer action
- None required
Summary
An external security researcher identified an authentication issue in the Keepnet Agentic AI API and reported it to security@keepnetlabs.com on 28 August 2026. Keepnet deployed a fix to production 74 minutes later. The fix applies to all customers automatically.
What the issue was
The Agentic AI API did not fully validate the X-Agentic-Ally-Token request header. A request with an invalid token could reach endpoints that return AI agent configuration: agent definitions, prompts, tool schemas and workflow definitions.
Impact
Agentic AI runs separately from the main Keepnet platform. Platform authentication and customer accounts were not affected.
The affected endpoints returned AI agent configuration only. A review of the live code and database confirmed they hold no customer data, personal data, account or credential information. Our investigation found no evidence that customer data was accessed or that any customer was affected.
Since the fix, every request with an invalid or missing token has been rejected: 4,187 requests to these endpoints up to 30 September 2026, none successful.
Customer action
None. Agentic AI is a fully hosted service. Keepnet applied the fix for all customers.
Timeline
All times UTC
- Researcher reported the issue to security@keepnetlabs.com
- Fix deployed to production (version 0ef61f2e)
- Researcher retested and confirmed the fix
- Keepnet confirmed resolution to the researcher and closed the case
- Keepnet completed its investigation and verified the fix again in production
- CVE-2026-92546 published by TR-CERT
What we have done
- Enforced server-side validation of the token header. Every request without a valid token is rejected.
- Closed the reported endpoints to external access.
- Reviewed authorisation on all related Agentic AI endpoints, including AI generation requests.
- Reviewed other Keepnet products for the same pattern. None was found.
- Expanded the scope of our security testing for this area.
- We run continuous automated penetration testing across the platform, with weekly reports available to customers.
- We run manual penetration tests at least once a year and after major releases.
Technical details
- CVE ID
- CVE-2026-92546
- Product
- Keepnet Agentic AI (hosted service)
- Affected endpoints
- /api/agents, /api/tools, /api/workflows
- Weakness
- CWE-290: Authentication bypass by spoofing
- CVSS 3.1 (as published by TR-CERT)
- 7.5
- Fixed in version
- 0ef61f2e
- Fixed
- 28 August 2026, 21:40 UTC, all customers
- Affected versions
- All versions before 0ef61f2e
- Customer action
- None
- CVE assigner
- TR-CERT
- Last updated
Frequently asked questions
What is CVE-2026-92546?
An authentication issue in the Keepnet Agentic AI API, found and reported by an external security researcher. Keepnet fixed it on 28 August 2026.
Was customer data affected?
No. The affected endpoints held AI agent configuration only. A review of the live code and database confirmed they hold no customer or personal data. Our investigation found no evidence that customer data was accessed or that any customer was affected.
Was the main Keepnet platform affected?
No. Agentic AI runs separately from the main platform. Platform authentication and customer accounts were not affected.
Do Keepnet customers need to take any action?
No. Agentic AI is a fully hosted service. Keepnet applied the fix for all customers.
How quickly was it fixed?
74 minutes after the report reached our security team.
Is the issue still present?
No. The researcher's retest on 31 August 2026 and Keepnet's own verification on 30 September 2026 both confirmed the fix.
Why does a fixed issue have a CVE?
The CVE program publishes records for issues in hosted services for transparency, including issues already fixed. Microsoft and Google follow the same practice for their cloud services.
How do I report a security issue to Keepnet?
Email security@keepnetlabs.com and follow the Keepnet Security Policy.
Questions about this advisory
Contact our security team at security@keepnetlabs.com.