CVE-2026-108756: CVE-2026-108756: eksik yetkilendirme

Açıklama (NVD)

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.

Özet bilgiler

CVSS v3.1

5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS v4.0

5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,22 (yüzdelik 12)

CWE

CWE-862

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• github.com
• github.com
• hackmd.io
• www.vulncheck.com
• CWE-862