AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-xq7h-vwjp-5vrh: @grackle-ai/powerline Runs Without Authentication by Default

mediumvulnerability

security

Source: GitHub Advisory DatabaseMarch 25, 2026

Summary

The PowerLine gRPC server (a service that runs code through remote procedure calls, which is a way for programs to request actions from each other over a network) from @grackle-ai/powerline runs without any authentication by default when a token is not provided, allowing anyone who can reach the server to execute code and access credentials. Although the server only listens on localhost (127.0.0.1, the local machine) by default, it becomes critically dangerous if accidentally exposed on a network through containers or port forwarding.

Solution / Mitigation

Update to version 0.70.1, which changes the behavior to require an explicit `--no-auth` flag to intentionally run without authentication, rather than silently defaulting to no auth. The fix throws an error if the server starts without a token and without the `--no-auth` flag. As a workaround for earlier versions, always provide `--token` or set the `GRACKLE_POWERLINE_TOKEN` environment variable when starting PowerLine.