Executive brief
Grackle is a framework for building multi-agent AI systems. The MCP (Model Context Protocol) tool layer has inconsistent authorization checks that allow scoped agents to modify or destroy tasks and sessions belonging to other agents or parent users—essentially letting one agent hijack another's work. An attacker with a compromised or prompt-injected agent can permanently delete peer tasks, falsify their completion status, or kill sibling agents.
Technical details
The vulnerability is a multi-part authorization bypass (IDOR/privilege-boundary escalation) in Grackle's MCP tool layer. The root cause is that the MCP server authenticates all outbound gRPC calls with the full server API key, and backend handlers perform no caller-based authorization; therefore authorization must be enforced per-tool in the MCP layer. However, mutating tools (task_update, task_delete, task_resume, session_kill, session_resume) inconsistently or completely omit the assertCallerIsAncestor check that read-only and some mutating tools perform. A scoped (agent) caller can learn peer task IDs via task_list/task_search, then call unguarded mutators to modify or destroy them. Additionally, workspaceless scoped tokens fail open to all workspaces (F7), and scoped-token revocation is unimplemented (F12). The advisory identifies five specific flaws bundled as Systemic Pattern A. No patch is yet available; remediation requires systemic central enforcement of task/session ancestry checks and proper workspace gating.
Affected products
- Grackle mcp ≤0.132.1
- Grackle auth ≤0.132.1
- Grackle plugin-core ≤0.132.1
Timeline
- 2026-07-02: disclosed: Advisory GHSA-f9ff-5x35-7gfw published