GHSA-647h-p824-99w7: @grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
- Identifier
- GHSA-647h-p824-99w7
- Published
- Record updated
- Affected
- @grackle-ai/mcp <= 0.70.1
- Fixed in
- 0.70.2
- released March 22, 2026, 3 days before disclosure
Summary
The knowledge_search and knowledge_get_node MCP tools in @grackle-ai/mcp are listed in SCOPED_TOOLS, so scoped agents can call them, but their handlers do not receive authContext or enforce workspace scoping. A scoped agent in Workspace A can pass an arbitrary workspaceId to read knowledge graph data from Workspace B, bypassing workspace isolation (CWE-284).
Mitigation
Fix: Add an authContext parameter to the knowledge_search and knowledge_get_node handlers and enforce workspace scoping, matching knowledge_create_node, using resolvedWorkspaceId = authContext?.type === "scoped" ? authContext.workspaceId ?? "" : workspaceId ?? "". Workarounds: do not use scoped agent tokens in multi-workspace deployments until patched, or remove knowledge_search and knowledge_get_node from the SCOPED_TOOLS set in tool-scoping.ts.
Topics
Related items
- MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database