Auth bypass in Rtk-ai Rtk
CVE-2026-54555
rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nes…
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Rtk-ai Rtk — versions < 0.42.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-54555?
- CVE-2026-54555 is a high-severity vulnerability in Rtk-ai Rtk, classified under Incorrect Authorization. CVSS score: 7.8/10. Published 2026-06-23.
- How severe is CVE-2026-54555?
- High severity. CVSS v3 base score is 7.8 out of 10.