HighVulnerability
GHSA-f9ff-5x35-7gfw: Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)
- Identifier
- GHSA-f9ff-5x35-7gfw
- Published
- Record updated
- Affected
- @grackle-ai/auth <= 0.132.1
- @grackle-ai/plugin-core <= 0.132.1
- @grackle-ai/mcp <= 0.132.1
- Fixed in
- No fixed version was stated when the source was last read.
Summary
Grackle's MCP server, `@grackle-ai/mcp` with `@grackle-ai/plugin-core` and `@grackle-ai/auth`, is affected through version 0.132.1 and earlier. Authorization for scoped agent callers is enforced inline per tool and omitted in several mutating tools, such as `task_update`, `task_delete`, `task_resume`, `session_kill` and `session_resume`, so a scoped agent can act on sibling, parent or cross-workspace tasks and sessions. Backend gRPC handlers perform no caller-based authorization, making the MCP tool layer the sole boundary.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
- HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
- InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
- MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database