Established 27 September 2026 · Last updated 7 November 2026
Security advisories
This is the public disclosure location for validated KushBitx vulnerabilities. Report issues privately through our vulnerability disclosure policy.
Published advisories
KBX-2026-001 · Low · Preflight signing decision did not require the Base chain ID
Published 6 November 2026 · Affected: @kushbitx/sdk 0.1.3 and earlier, @kushbitx/agentkit 0.1.1 and earlier · Fixed in @kushbitx/sdk 0.1.4 and @kushbitx/agentkit 0.1.2. Upgrade to @kushbitx/agentkit 0.1.3 (see KBX-2026-002).
In affected versions, canSign could be true for a Base ALLOW report even when the agent's transaction did not state chain ID 8453. An agent that relied only on canSign could sign the same call data on another network. Fixed versions require chainId: 8453, include it in the transaction digest, and return canSign: false for any other network.
Action: upgrade. No KushBitx server change was needed, and no funds held by KushBitx were affected. No CVE ID is assigned.
KBX-2026-002 · Low · AgentKit overall payment cap did not apply to KushBitx Preflight
Published 6 November 2026 · Affected: @kushbitx/agentkit 0.1.1 and 0.1.2 · Fixed in @kushbitx/agentkit 0.1.3.
In affected versions, kushbitx_preflight_transaction used only maxPreflightUsdc (default 0.005 USDC) and ignored a lower maxPaymentUsdc. An agent configured with maxPaymentUsdc: "0.001" could pay 0.005 USDC for one Preflight call. Payments still went only to the published KushBitx address at the published price. Version 0.1.3 uses the lower of the two caps.
Action: upgrade to 0.1.3. No CVE ID is assigned.
Disclosure format
Each future advisory will identify its publication and update dates, affected components and versions, impact, fixed versions or mitigations, references and a CVE ID where assigned by an authorized CNA. No CVE authority is claimed.
