{"data":{"id":"3f2c11b3-7a81-455e-a56c-0fbc9a06215e","title":"GHSA-f9ff-5x35-7gfw: Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)","summary":"Grackle's MCP server, `@grackle-ai/mcp` with `@grackle-ai/plugin-core` and `@grackle-ai/auth`, is affected through version 0.132.1 and earlier. Authorization for scoped agent callers is enforced inline per tool and omitted in several mutating tools, such as `task_update`, `task_delete`, `task_resume`, `session_kill` and `session_resume`, so a scoped agent can act on sibling, parent or cross-workspace tasks and sessions. Backend gRPC handlers perform no caller-based authorization, making the MCP tool layer the sole boundary.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-f9ff-5x35-7gfw","publishedAt":"2026-07-02T19:35:03.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@grackle-ai/auth@<= 0.132.1","@grackle-ai/plugin-core@<= 0.132.1","@grackle-ai/mcp@<= 0.132.1"],"affectedPackageNames":["@grackle-ai/auth","@grackle-ai/plugin-core","@grackle-ai/mcp"],"affectedPackageRefs":["npm:@grackle-ai/mcp","npm:@grackle-ai/plugin-core","npm:@grackle-ai/auth"],"affectedVendors":[],"affectedVendorsRaw":["Grackle","@grackle-ai/mcp","MCP (Model Context Protocol) tool layer"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-f9ff-5x35-7gfw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-07-02T19:35:03.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}