Executive brief
Grackle PowerLine is a gRPC server component used to orchestrate AI coding agents on remote machines. When deployed without explicit authentication credentials, the server defaults to running with zero authentication, allowing any local or remote client with network access to spawn agent sessions, steal credentials, and execute arbitrary code. While the default binding is localhost-only, accidental network exposure (e.g., in containers or via port forwarding) creates a critical security gap.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the PowerLine gRPC server initialization. When the --token parameter is not provided and the GRACKLE_POWERLINE_TOKEN environment variable is not set, the auth interceptor is never applied, leaving the server unauthenticated despite logging a "NO AUTH (development only)" warning. An attacker with network access to the PowerLine gRPC port can invoke any method without credentials, spawning sessions and executing code. The default binding to 127.0.0.1 limits local exposure, but container deployments or port forwarding misconfigurations expose the vulnerability to network attack. The fix (version 0.70.1) requires an explicit --no-auth flag to permit unauthenticated operation, or throws an error if neither a token nor the flag is provided.
Affected products
- Grackle PowerLine <= 0.70.0
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: Version 0.70.1 released