Missing Authentication for Critical Function Affecting @grackle-ai/powerline package, versions <0.70.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authentication for Critical Function vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-GRACKLEAIPOWERLINE-15871386
- published1 Apr 2026
- disclosed25 Mar 2026
- creditUnknown
Introduced: 25 Mar 2026
New CVE NOT AVAILABLE CWE-306 (opens in a new tab)How to fix?
Upgrade @grackle-ai/powerline to version 0.70.1 or higher.
Overview
@grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration
Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the PowerLine gRPC server when when --token is not provided and GRACKLE_POWERLINE_TOKEN is not set. An attacker can gain unauthorized access, spawn agent sessions, retrieve credential tokens, and execute arbitrary code by connecting to the exposed service. This is only exploitable if the service is bound to a non-localhost interface or is otherwise accessible from outside the local machine.