{"data":{"id":"4650a91a-07f2-4d60-8672-141559874fea","title":"GHSA-xq7h-vwjp-5vrh: @grackle-ai/powerline Runs Without Authentication by Default","summary":"The PowerLine gRPC server in @grackle-ai/powerline runs with no authentication when neither the --token flag nor the GRACKLE_POWERLINE_TOKEN variable is set. It only logs a warning, and any client that can reach the port can spawn agent sessions, access credential tokens and execute code. The default binding to 127.0.0.1 limits exposure, but accidental network exposure, such as in a container or through port forwarding, makes the impact critical.","solution":"Fixed in 0.70.1: PowerLine now requires an explicit --no-auth flag to run without authentication, and throws an error when started without a token and without --no-auth. Workaround: always provide --token or set GRACKLE_POWERLINE_TOKEN when starting PowerLine.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xq7h-vwjp-5vrh","publishedAt":"2026-03-25T17:30:46.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@grackle-ai/powerline@<= 0.70.0 (fixed: 0.70.1)"],"affectedPackageNames":["@grackle-ai/powerline"],"affectedPackageRefs":["npm:@grackle-ai/powerline"],"affectedVendors":[],"affectedVendorsRaw":["Grackle PowerLine"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-xq7h-vwjp-5vrh"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-25T17:30:46.000Z","fixReleasedAt":"2026-03-22T18:06:39.534Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:39:38.070Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@grackle-ai/powerline","fixedVersion":"0.70.1","matchedVersion":"0.70.1","fixReleasedAt":"2026-03-22T18:06:39.534Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:37.894Z"}]}}