Executive brief
Grackle AI Server is a platform for managing and orchestrating AI coding agents. The server's WebSocket endpoint fails to validate the Origin header when accepting connections, allowing a malicious webpage to hijack active user sessions and subscribe to sensitive real-time events like task updates and environment state if a user visits an attacker-controlled site while logged in.
Technical details
The vulnerability is a missing origin validation (CWE-346) in the WebSocket upgrade handler at packages/server/src/ws-bridge.ts:80-91. The handler checks authentication via API key or session cookie but omits validation of the req.headers.origin header. An attacker can exploit this via cross-origin WebSocket hijacking: if a user has an active Grackle session (protected by SameSite=Lax cookie) and visits a malicious webpage, that page can open a WebSocket connection to ws://localhost:3000/ws and receive real-time events without the server verifying the connection origin. No user interaction beyond visiting the malicious site is required. The fix involves validating origin against an allowlist before accepting WebSocket upgrades; patched in version 0.70.3.
Affected products
- Grackle AI Server <= 0.70.2
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: Fixed in version 0.70.3