Abilityai Trinity EUVD-2026-96921

Requires a running Trinity instance (version through 0.9.5) that has a Telegram binding configured, and the attacker must control an agent possessing a valid agent-scoped MCP API key - typically achieved via prompt injection against that agent. The Telegram binding routes fail to restrict human-only binding operations (bind/replace/delete) to human operators, so any agent-scoped key can invoke them. Limiting factors: the attacker cannot act fully unauthenticated (an agent-scoped key is needed, hence PR:L), the Telegram integration must be in use, and impact is bounded to messaging binding manipulation (message spoofing via owner bot, token replacement, or binding deletion) rather than full host compromise.

This is a genuine but moderate-priority issue, not an inflated high-CVSS item. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 (Medium), and the signals are internally consistent: network-reachable, low complexity, but requiring an already-held agent-scoped MCP API key (PR:L) and yielding only low integrity and availability impact with no confidentiality loss. It is NOT listed in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis', though a third-party technical writeup is referenced (hackmd). The real risk is contextual rather than broad: it only matters to organizations running Trinity with an exposed/compromisable agent, where prompt injection is a plausible and increasingly common initial vector for LLM agents. Because the privilege requirement (control of an agent + a valid agent-scoped key) is a real barrier and the affected product has a small footprint, this is a targeted, environment-specific concern rather than a mass-exploitation threat. Missing data to note explicitly: EPSS and formal POC/KEV flags were absent from the input, so exploitation probability could not be quantified.

An attacker uses prompt injection to seize control of a Trinity agent that holds an agent-scoped MCP API key. Because the Telegram binding routes do not enforce the human-only authorization check, the attacker invokes them with the agent key to send messages through the owner's bot token or to replace the owner's bot token with their own. A referenced technical writeup details the vulnerable routes, but no packaged public exploit is confirmed in the input.