CVE-2026-108756: Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Abilityai Trinity through 0.9.5 are exposed where an agent has an agent-scoped MCP API key and Telegram binding functionality is available. An attacker would typically need to control that agent, for example through prompt injection.
What can an attacker do after exploiting the missing authorization?
An attacker controlling an agent can use the owner's bot token to send Telegram messages. They can also replace the Telegram binding with a token they control or delete the binding.
Are credentials other than an agent-scoped MCP API key required for exploitation?
The described issue allows an agent-scoped MCP API key to invoke operations intended only for humans. The provided information does not indicate that the attacker must separately possess the owner's Telegram bot token.