AIKIDO-2026-444901
agent-manifest is vulnerable to Improper Check for Unusual or Exceptional Conditions
31
Low Risk
This Affects:
agent-manifestTL;DR
The integrated verifier does not check the audit_key_sealed flag when attestation enforcement is enabled. A manifest that declares the audit key as not sealed still returns a valid verdict, contrary to the requirement that the audit key be sealed under attestation enforcement. The verifier reads the audit chain root but never evaluates the seal flag, so the control is not enforced. The fix validates audit_key_sealed during attestation-enforced verification.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify manifests with attestation enforcement enabled.
Background info
agent-manifest is vulnerable to Improper Check for Unusual or Exceptional Conditions in versions 0.0.1 - 0.11.2.
How to fix this
Upgrade the agent-manifest library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.