BotSharp’s Starter Ships a Hard-Coded Signing Key. Every Agent Built On It Inherits the Forgery Path.
Photo: Forkast
The signing key for the framework’s login tokens sits in the starter template’s configuration file, in the repository, in plain text. This flaw, identified as CVE-2026-108860, represents a failure of trust-through-defaults at the supply-chain layer. A framework that ships its trust root as a source constant provides every agent built on its starter with a pre-baked forgery path. This issue sits one level below the pattern described in our previous analysis, Ships Without Auth . In those cases, the control planes lacked authentication entirely. Here, the authentication gate exists and functions as designed.
Source: Forkast
