Trinity
Monthly
Missing authorization in the Telegram router of Abilityai Trinity (through version 0.9.5) lets an agent-scoped MCP API key invoke binding operations that are intended to be human-only, including sending messages through the owner's bot token, replacing the Telegram binding with an attacker-controlled token, or deleting the binding outright. An attacker must first gain control of an agent holding a valid agent-scoped MCP key - typically achieved through prompt injection - so this is an authenticated (PR:L) issue rather than a pre-auth one, and impact is bounded to manipulation of the Telegram messaging binding rather than host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority authorization flaw rather than a high-severity item.
Missing authorization in the Telegram router of Abilityai Trinity (through version 0.9.5) lets an agent-scoped MCP API key invoke binding operations that are intended to be human-only, including sending messages through the owner's bot token, replacing the Telegram binding with an attacker-controlled token, or deleting the binding outright. An attacker must first gain control of an agent holding a valid agent-scoped MCP key - typically achieved through prompt injection - so this is an authenticated (PR:L) issue rather than a pre-auth one, and impact is bounded to manipulation of the Telegram messaging binding rather than host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority authorization flaw rather than a high-severity item.