Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Abilityai

    CVE-2026-108756 (GCVE-0-2026-108756)

    Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-11 12:19
    VLAI
    Title
    Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
    Summary
    Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5496 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Abilityai trinity Affected: 0 , ≤ 0.9.5 (semver)
        cpe:2.3:a:trinity_project:trinity:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-10-10 00:00
    Credits
    HaiND from the Post and Telecommunication Institute of Technology
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Abilityai/trinity",
          "product": "trinity",
          "repo": "https://github.com/Abilityai/trinity",
          "vendor": "Abilityai",
          "versions": [
            {
              "lessThanOrEqual": "0.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:trinity_project:trinity:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.9.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner\u0027s bot token, replace the binding with their own token, or delete it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:54.615Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/rJ2OBa8sfl"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Abilityai/trinity/blob/e38c1c0f2567c602541c90c4c92152e99e6ead11/src/backend/routers/telegram.py#L168-L219"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Abilityai/trinity/blob/e38c1c0f2567c602541c90c4c92152e99e6ead11/src/backend/routers/telegram.py#L258-L323"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Abilityai/trinity"
        },
        {
          "name": "VulnCheck Advisory: Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/abilityai-trinity-through-0.9.5-missing-authorization-in-telegram-binding-routes"
        }
      ],
      "title": "Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108756",
    "datePublished": "2026-10-11T12:19:54.615Z",
    "dateReserved": "2026-10-11T01:57:24.159Z",
    "dateUpdated": "2026-10-11T12:19:54.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-108756 (GCVE-0-2026-108756)

    Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-11 12:19
    VLAI
    Title
    Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
    Summary
    Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5496 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Abilityai trinity Affected: 0 , ≤ 0.9.5 (semver)
        cpe:2.3:a:trinity_project:trinity:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-10-10 00:00
    Credits
    HaiND from the Post and Telecommunication Institute of Technology
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Abilityai/trinity",
          "product": "trinity",
          "repo": "https://github.com/Abilityai/trinity",
          "vendor": "Abilityai",
          "versions": [
            {
              "lessThanOrEqual": "0.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:trinity_project:trinity:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.9.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner\u0027s bot token, replace the binding with their own token, or delete it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:54.615Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/rJ2OBa8sfl"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Abilityai/trinity/blob/e38c1c0f2567c602541c90c4c92152e99e6ead11/src/backend/routers/telegram.py#L168-L219"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Abilityai/trinity/blob/e38c1c0f2567c602541c90c4c92152e99e6ead11/src/backend/routers/telegram.py#L258-L323"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Abilityai/trinity"
        },
        {
          "name": "VulnCheck Advisory: Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/abilityai-trinity-through-0.9.5-missing-authorization-in-telegram-binding-routes"
        }
      ],
      "title": "Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108756",
    "datePublished": "2026-10-11T12:19:54.615Z",
    "dateReserved": "2026-10-11T01:57:24.159Z",
    "dateUpdated": "2026-10-11T12:19:54.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}